Apply audit remediation

Apply audit remediation from the 2026-06-10 review.

Author: Pigbibi

.github/workflows/ci.yml

@@ -5,9 +5,13 @@ on:
     branches: ["main"]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6

.github/workflows/dispatch_shadow_signal.yml

@@ -27,9 +27,14 @@ permissions:
   contents: read
   issues: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   dispatch-shadow-signal:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       BRIDGE_REPOSITORY: ${{ vars.SELFHOSTED_CODEX_REVIEW_REPOSITORY || 'QuantStrategyLab/CodexAuditBridge' }}
       BRIDGE_TASK: long_horizon_signal_shadow

.github/workflows/theme_momentum_snapshot.yml

@@ -36,9 +36,14 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   build-theme-momentum:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6