Cancel superseded CI runs and add job timeouts

.github/workflows/pr.yaml

@@ -6,10 +6,20 @@ on:
   push:
     branches: [main]
 
+# A newer commit on a pull request makes the run on its previous head moot.
+# Cancel that run rather than let it wait in the org-wide runner queue. From
+# 2026-10-06 to 10-08, 44 of 92 runs were superseded before they finished.
+# Pushes to main get a group of their own per run, so every main commit keeps
+# its own result and none is cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
@@ -19,6 +29,7 @@ jobs:
   test:
     name: Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
@@ -28,6 +39,7 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2