ci: add concurrency cancellation + job timeouts to model-zoo CI

[LukasWodka]

Summary

Mechanical CI-hygiene change to .github/workflows/ci.yml. No change to what any job does.

• Adds a top-level concurrency: group keyed on github.ref, with cancel-in-progress scoped to pull_request events only — so a PR re-push cancels its own superseded run instead of stacking the heavy framework test matrices. Pushes to branches are not cancelled.
• Adds timeout-minutes as the first key of every job:
  • ruff → 10
  • test-pytorch / test-tensorflow / test-sklearn / test-survival → 30 (these pip-install torch/tensorflow/etc., so they're heavier)

This caps hung installs at the configured limit instead of letting them run to the 6h GitHub default.

Type

CI hygiene

Test plan

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))" → YAML OK
• Diff contains only the concurrency: block + per-job timeout-minutes additions; no job runs-on/steps lines changed.

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 35 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• .github#60 — feat(security): public-repo PII gate (block customer names + secrets in PRs) · author: @LukasWodka · no reviewer assigned
• averaging-service#117 — refactor(averaging): per-framework weight-handling seam (WS-B B1) · author: @divyasinghds · no reviewer assigned
• averaging-service#118 — feat(averaging): trainable-only keyed-dict weight format (WS-C fix(nlp): bake pad padding into causal/MLM/token/text tokenizers #104) · author: @divyasinghds · no reviewer assigned
• averaging-service#119 — fix(averaging): exact federated GaussianNB merge — usable + correct (WS-B B2, #112) · author: @divyasinghds · no reviewer assigned
• averaging-service#120 — ci: add concurrency cancellation + job timeouts to averaging-service CI · author: @LukasWodka · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#829 — feat(#817): failure surfaces a reason end-to-end + stuck-run reaper (WS6 I3/I4/I5/I8) · author: @saadqbal · no reviewer assigned
• cli#78 — fix(dataset rm): delete staging files from a uid-65532 pod, not jobs-manager (#259) · author: @LukasWodka · no reviewer assigned
• cli#79 — chore(schema): re-sync vendored ingest.v1.json from data-ingestors master · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)