ci: timeouts and cancel-in-progress for superseded runs

[AminDhouib]

Timeouts. Each job below had no timeout-minutes, so it inherited the
GitHub default of 360 minutes. On a fixed-size self-hosted pool that is what
a hung step really costs: one wedged run holds a slot for six hours and every
queued run waits behind it.

The value is 3 x the job's observed p90 over 72 h, rounded up to the nearest
5; where history showed no usable sample the job takes its class default
instead. Class and source are given per job.

.github/workflows/ai-evals.yml
notify-on-nightly-failure 30 min class=other class default (no observed runs)

.github/workflows/checks-app.yml
audit 30 min class=other class default (no observed runs)
schema-drift 20 min class=unit-test class default (no observed runs)
test-matrix 20 min class=unit-test class default (no observed runs)

.github/workflows/checks-extension.yml
lint_and_build 30 min class=build class default (no observed runs)

.github/workflows/release-extension.yml
github_release 60 min class=release class default (no observed runs)
guard 30 min class=other class default (no observed runs)
package 20 min class=unit-test class default (no observed runs)
publish_chrome 60 min class=release class default (no observed runs)
publish_edge 60 min class=release class default (no observed runs)
publish_firefox 60 min class=release class default (no observed runs)

.github/workflows/submit-extension-chrome.yml
submit 30 min class=other class default (no observed runs)

.github/workflows/watch-store-versions.yml
watch 30 min class=other class default (no observed runs)

Concurrency. A superseded run is one whose commit a newer push to the same
ref has already replaced; nothing reads its result, but it still holds a
runner slot until it finishes.

.github/workflows/checks-extension.yml
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

The group keys on workflow and ref, so runs supersede only within one ref;
a branch never cancels another branch. The default branch (main) cancels
superseded runs too, because these are CI-only workflows: no deploy step, no
publish step and no environment:, so no downstream state depends on a run
that a newer commit has already replaced. The newest commit on the ref still
gets a full CI result recorded against it.

Part of the CI pool right-sizing programme; edits derived from 72 h of run history.