fix(ci): add timeout-minutes and concurrency guard to masterplan-lock

Fleet-wide CI-speed pass: masterplan-lock.yml had no job-level
timeout-minutes (a hung runner could block indefinitely) and triggers
on both push (branches: ["**"]) and pull_request, which runs the same
check twice per PR commit. Add a 10-minute timeout for this cheap
single-check job and a concurrency group (matching the pattern already
used in admin/serv0, admin/s0cial, admin/ppl0, admin/pers0n) to cancel
the superseded duplicate run without changing what triggers CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/masterplan-lock.yml

@@ -12,9 +12,14 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: https://git.siax.io/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # mirrored, immutable
       - name: Masterplan lock check