Cap what a single fork pull request can spend

.github/workflows/ci.yml

@@ -6,6 +6,14 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  # A new push to the same PR or branch supersedes the run in flight. Without
+  # this every push queued a *fresh* full set of jobs alongside the old ones,
+  # so a branch pushed five times held five complete matrices at once — on
+  # paid Blacksmith runners, and with nothing reclaiming the superseded work.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
@@ -14,6 +22,12 @@ jobs:
   test:
     name: Test
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    # Capped because the GitHub default is **six hours** per job, and this
+    # workflow is reachable from a fork pull request. Measured over the last
+    # six runs the slowest job here is 30s, so 20 minutes is roughly 40x
+    # headroom while removing the runaway: a stuck or hostile job now costs
+    # 20 minutes of a paid runner rather than a working day of one.
+    timeout-minutes: 20
     strategy:
       matrix:
         features: ["", "--all-features", "--no-default-features"]
@@ -35,6 +49,7 @@ jobs:
   lint:
     name: Lint
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
 
@@ -55,6 +70,7 @@ jobs:
   docs:
     name: Documentation
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
 
@@ -72,6 +88,7 @@ jobs:
   msrv:
     name: MSRV (1.93)
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6