Cancel superseded PR CI runs and add job timeouts

[MaxGhenis]

What

• CI and Paper get a workflow-level concurrency group. A new push to a pull request cancels that pull request's older run. Pushes to main get a group of their own per run (github.run_id), so they are never cancelled or left pending behind one another.
• Every job gets timeout-minutes, so a hung job frees its runner instead of holding it for GitHub's 6-hour default.

Why

The PolicyEngine org is on the GitHub Team plan, which allows 60 concurrent jobs on standard GitHub-hosted runners (Actions limits). On 2026-10-08 at 23:18Z the org had 57 jobs in progress and 167 queued. This repo's workflows had no concurrency group, so a superseded run kept its slots: run 37852440356 was still running two jobs on a commit that PR #200 had already replaced.

Timeouts and the durations behind them

From the last 12 successful runs of each workflow (2026-10-05 to 10-08):

Job	Slowest	Timeout
CI / lint	0.3 min	10
CI / test	7.2 min	30
CI / app	1.9 min	15
Paper / paper	2.0 min	20

Checks

• actionlint passes on both files.
• The two workflows have different names, so their groups cannot collide.
• No status check is required on main (branch is unprotected), and no job name changes.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
policybench-site	Ready	Preview	Oct 8, 2026 11:41pm UTC

[MaxGhenis]

Landing on the merge gates. Audit at head faab7a01583ef67f6534d839bb5665404c062a0f:

• gh pr checks exits 0 (6 passed, 0 skipped by design); mergeable is MERGEABLE; not a draft; no changes-requested review.
• Independent review: a Codex reviewer on a Subfleet lane (run 20261008-194225-pe-ci-six-prs), which did not write the change, approved this head with no blocking findings. Verdict: ~/reviews/pe-actions-concurrency-2026-10-08/review-six-out.md. Its notes on stale description text were fixed in the description.
• The landing session (local_cfdb0a5b) read the full diff at this head. The change touches only CI workflow configuration.
• Context: the PolicyEngine org is at GitHub's limit of 60 concurrent standard-runner jobs for the Team plan, so superseded and hung jobs delay every repo's checks.