chore(ci): add concurrency groups and job timeouts to CI workflows

Added workflow-level concurrency groups with cancel-in-progress to both
ci.yml and nightly-quality.yml so that superseded CI runs are automatically
cancelled when a new commit is pushed to the same branch. Added per-job
timeout-minutes to all 11 CI jobs and the nightly quality job to prevent
hung jobs from occupying runner slots indefinitely:

  - 10 min: lint, typecheck, security, quality, build
  - 20 min: unit_tests, integration_tests
  - 30 min: coverage, benchmark-regression, benchmark-publish, docker
  - 45 min: nightly full-quality-suite

These changes reduce runner contention across concurrent PR builds and
provide a hard upper bound on job execution time.

ISSUES CLOSED: #451

.forgejo/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
     pull_request:
         branches: [master, develop*]
 
+concurrency:
+    group: ci-${{ forgejo.workflow }}-${{ forgejo.ref }}
+    cancel-in-progress: true
+
 env:
     UV_VERSION: "0.8.0"
     PYTHON_VERSION: "3.13"
@@ -14,6 +18,7 @@ env:
 jobs:
     lint:
         runs-on: docker
+        timeout-minutes: 10
         container:
             image: python:3.13-slim
         steps:
@@ -41,6 +46,7 @@ jobs:
 
     typecheck:
         runs-on: docker
+        timeout-minutes: 10
         container:
             image: python:3.13-slim
         steps:
@@ -62,6 +68,7 @@ jobs:
 
     security:
         runs-on: docker
+        timeout-minutes: 10
         container:
             image: python:3.13-slim
         steps:
@@ -89,6 +96,7 @@ jobs:
 
     quality:
         runs-on: docker
+        timeout-minutes: 10
         container:
             image: python:3.13-slim
         steps:
@@ -110,6 +118,7 @@ jobs:
 
     unit_tests:
         runs-on: docker
+        timeout-minutes: 20
         container:
             image: python:3.13-slim
         steps:
@@ -131,6 +140,7 @@ jobs:
 
     integration_tests:
         runs-on: docker
+        timeout-minutes: 20
         container:
             image: python:3.13-slim
         steps:
@@ -152,6 +162,7 @@ jobs:
 
     coverage:
         runs-on: docker
+        timeout-minutes: 30
         container:
             image: python:3.13-slim
         needs: [lint, typecheck]
@@ -210,6 +221,7 @@ jobs:
     benchmark-regression:
         if: forgejo.event_name == 'pull_request'
         runs-on: docker
+        timeout-minutes: 30
         container: 
             image: python:3.13-slim
         needs: [lint, typecheck]
@@ -267,6 +279,7 @@ jobs:
     benchmark-publish:
         if: forgejo.event_name == 'push' && ( forgejo.ref == 'refs/heads/master' || forgejo.ref == 'refs/heads/develop' )
         runs-on: docker
+        timeout-minutes: 30
         container: python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, git for merge tests)
@@ -323,6 +336,7 @@ jobs:
 
     build:
         runs-on: docker
+        timeout-minutes: 10
         container:
             image: python:3.13-slim
         steps:
@@ -345,6 +359,7 @@ jobs:
     docker:
         needs: [lint, typecheck, unit_tests, security]
         runs-on: docker
+        timeout-minutes: 30
         container:
             image: docker:dind
             options: --privileged

.forgejo/workflows/nightly-quality.yml

@@ -7,6 +7,10 @@ on:
   workflow_dispatch:
     # Allow manual trigger for testing
 
+concurrency:
+  group: nightly-quality-${{ forgejo.workflow }}-${{ forgejo.ref }}
+  cancel-in-progress: true
+
 env:
   UV_VERSION: "0.8.0"
   PYTHON_VERSION: "3.13"
@@ -15,6 +19,7 @@ env:
 jobs:
   full-quality-suite:
     runs-on: docker
+    timeout-minutes: 45
     container:
       image: python:3.13-slim
     steps:

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+- Added concurrency groups (`cancel-in-progress: true`) and per-job `timeout-minutes` to
+  the CI and Nightly Quality workflows, so that superseded CI runs are automatically
+  cancelled when a new commit is pushed to the same branch and hung jobs are killed after a
+  bounded time limit (10 min for lint/typecheck/security/quality/build, 20 min for test
+  jobs, 30 min for coverage/benchmarks/docker, 45 min for nightly quality). (#451)
 - Added token/cost tracking, budget enforcement (per-plan and per-day), provider fallback
   selection with capability filtering, and cost metadata for plan execution. New config keys
   `budget_per_plan`, `budget_per_day`, and `fallback_providers` control spending limits and