chore(ci): harden CI workflows (#135)

- Add job-level timeout-minutes to all workflows (15-45 min depending on job).
- Add concurrency group with PR-only cancel-in-progress to benchmarks workflow.
- Add version comment to autofix-ci/action SHA pin (v1.3.2).

No behavioral changes: test commands, schedules, deploy targets, matrix configs,
and notification settings are untouched.

Co-authored-by: Sarah Gerrard <gerrardsarah@gmail.com>

Author: AlemTuzlak

.github/workflows/autofix.yml

@@ -16,6 +16,7 @@ jobs:
   autofix:
     name: autofix
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -28,6 +29,6 @@ jobs:
       - name: Regenerate docs
         run: pnpm build:all && pnpm generate-docs
       - name: Apply fixes
-        uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27
+        uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2
         with:
           commit-message: 'ci: apply automated fixes'

.github/workflows/benchmarks.yml

@@ -17,6 +17,10 @@ on:
       - 'pnpm-workspace.yaml'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -28,6 +32,7 @@ jobs:
   benchmarks:
     name: Run intent CodSpeed benchmark
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       id-token: write

.github/workflows/pr.yml

@@ -21,6 +21,7 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -38,6 +39,7 @@ jobs:
   preview:
     name: Preview
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/release.yml

@@ -20,6 +20,7 @@ jobs:
     name: Release
     if: "!contains(github.event.head_commit.message, 'ci: changeset release')"
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     permissions:
       contents: write
       id-token: write

.github/workflows/zizmor.yml

@@ -12,6 +12,7 @@ jobs:
   zizmor:
     name: Run zizmor
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2