Add concurrency control and job timeouts in CI

- Cancel superseded CI runs on the same PR (keyed by PR number); push/tag/
  release runs get unique groups via run_id so the release pipeline's
  workflow_call is never interrupted.
- Add timeout-minutes to every CI job to replace the implicit 6h default.
- Group Dependabot minor/patch updates per ecosystem (gomod, github-actions);
  major updates still open individual PRs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gtsiolis

.github/dependabot.yml

@@ -10,6 +10,13 @@ updates:
     labels:
       - "semver: patch"
       - "docs: skip"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -21,3 +28,10 @@ updates:
     labels:
       - "semver: patch"
       - "docs: skip"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/ci.yml

@@ -15,10 +15,18 @@ permissions:
   pull-requests: write
   checks: write
 
+# Cancel superseded runs on the same PR; never cancel push/tag/release runs
+# (each gets a unique group via run_id) so reusable workflow_call from the
+# release pipeline is never interrupted.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -36,6 +44,7 @@ jobs:
   goreleaser-check:
     name: GoReleaser Check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -50,6 +59,7 @@ jobs:
   test-unit:
     name: Unit Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -83,6 +93,7 @@ jobs:
   test-integration:
     name: Integration Tests (${{ matrix.os }}${{ matrix.shard && format(' shard {0}/{1}', matrix.shard, matrix.shard_total) || '' }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -186,6 +197,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test-integration
     if: always()
+    timeout-minutes: 5
     steps:
       - name: Verify integration matrix succeeded
         run: |
@@ -203,6 +215,7 @@ jobs:
       - test-unit
       - test-integration
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
     steps: