ci: add concurrency cancellation + job timeouts to cli CI

[LukasWodka]

Summary

Small, mechanical CI-hygiene change across the three cli workflows. No job behavior changes — only adds run-cancellation and per-job timeouts.

• Per-ref concurrency group added to each workflow (build, release, e2e). cancel-in-progress is gated on github.event_name == 'pull_request', so superseded PR runs are cancelled while push / tag / schedule runs are never cancelled.
• timeout-minutes on every job so a hung step (kind boot, cosign keyless signing, a stuck go test) can't burn to the 6h GitHub default.

Timeouts applied

File	Job	timeout-minutes
build.yml	schema-drift	10
build.yml	test	15
build.yml	lint	10
build.yml	build (cross-compile matrix)	20
release.yml	release (build + sign matrix)	20
release.yml	publish	20
release.yml	bump-homebrew-tap	20
e2e.yml	integration (kind cluster)	30

Type

CI hygiene.

Test plan

• All three workflows re-parse as valid YAML (yaml.safe_load).
• Diff is concurrency blocks + timeout-minutes keys only — no step, trigger, permission, or matrix changes.
• concurrency added only where absent; timeout-minutes added only to jobs lacking one.

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 36 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• .github#60 — feat(security): public-repo PII gate (block customer names + secrets in PRs) · author: @LukasWodka · no reviewer assigned
• averaging-service#117 — refactor(averaging): per-framework weight-handling seam (WS-B B1) · author: @divyasinghds · no reviewer assigned
• averaging-service#118 — feat(averaging): trainable-only keyed-dict weight format (WS-C feat(cli): client create --credential-file — write the credential for the installer (#84) #104) · author: @divyasinghds · no reviewer assigned
• averaging-service#119 — fix(averaging): exact federated GaussianNB merge — usable + correct (WS-B B2, cli: logout must call POST /auth/revoke to revoke the token server-side (RFC-0001 R2 / §7.5) #112) · author: @divyasinghds · no reviewer assigned
• averaging-service#120 — ci: add concurrency cancellation + job timeouts to averaging-service CI · author: @LukasWodka · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#829 — feat(#817): failure surfaces a reason end-to-end + stuck-run reaper (WS6 I3/I4/I5/I8) · author: @saadqbal · no reviewer assigned
• cli#78 — fix(dataset rm): delete staging files from a uid-65532 pod, not jobs-manager (#259) · author: @LukasWodka · no reviewer assigned
• cli#79 — chore(schema): re-sync vendored ingest.v1.json from data-ingestors master · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)