release(runway): cherry-pick ci: GitHub Actions time usage optimizations (#36896)

- ci: GitHub Actions time usage optimizations (#36629)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

- [Add `concurrency` field to

`update-lavamoat-policies`.](a20025f)
- Saves approx. 20 minutes of billable time (=runtime of
`update-lavamoat-policies`) for each `@metamaskbot update-policies`
comment.
- Cancels CI run when the comment is posted, instead of waiting for the
`update-lavamoat-policies` workflow to complete.
- Excluded release branches, where even an incomplete CI run might
provide useful info.

- Set `timeout-minutes` for all jobs to 30 (instead of default of 360).
- Example of 6-hour run:

https://github.com/MetaMask/metamask-extension/actions/runs/18155641151/job/51675026463?pr=33539

> All jobs should set

[timeout-minutes](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idtimeout-minutes).
> ...
> By default, GitHub Actions kills workflows after 6 hours if they have
not finished by then. Many workflows don't need nearly as much time to
finish, but sometimes unexpected errors occur or a job hangs until the
workflow run is killed 6 hours after starting it. Therefore it's
recommended to specify a shorter timeout.
> ...
> This has the following advantages:
> 
> PRs won't be pending CI for half the day, issues can be caught early
or workflow runs can be restarted. The number of overall parallel builds
is limited, hanging jobs will not cause issues for other PRs if they are
cancelled early.
>
> --

[`ghalint`](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/012.md#job_timeout_minutes_is_required)

[![Open in GitHub

Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36629?quickstart=1)

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to this page...
2.
3.

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding

Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling

guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Sets 30-minute timeouts across GitHub Actions jobs and adds
concurrency to `update-lavamoat-policies` to cancel superseded runs
(excluding `release/*`).
> 
> - **CI/GitHub Actions**
> - **Job timeouts**: Add `timeout-minutes: 30` to jobs across workflows
(e.g., `main.yml`, tests, builds, e2e, releases, checks) to cap runtime.
> - **Concurrency control**: Add `concurrency` to
`update-lavamoat-policies.yml` to cancel in-progress runs for the same
ref, excluding `release/*` branches.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8169786. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->


[8453e5e](8453e5e)

Co-authored-by: Jongsun Suh <[email protected]>

Author: runway-github[bot]

.github/workflows/auto-create-release-pr.yml

@@ -7,6 +7,7 @@ jobs:
   extract:
     if: ${{ github.ref_type == 'branch' && (startsWith(github.ref, 'refs/heads/Version-v') || startsWith(github.ref, 'refs/heads/release/')) }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     outputs:
       semver: ${{ steps.out.outputs.semver }}
     steps:

.github/workflows/auto-update-pr-targeting-release.yml

@@ -10,6 +10,7 @@ jobs:
   auto-update:
     name: Auto-update
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
       YARN_ENABLE_HARDENED_MODE: false

.github/workflows/build-storybook.yml

@@ -10,6 +10,7 @@ jobs:
   build-storybook:
     name: Build storybook
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       # For a `pull_request` event, the branch is `github.head_ref``.
       # For a `push` event, the branch is `github.ref_name`.

.github/workflows/build-ts-migration-dashboard.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   build-ts-migration-dashboard:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       # For a `pull_request` event, the branch is `github.head_ref``.
       # For a `push` event, the branch is `github.ref_name`.

.github/workflows/check-attributions.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   check-attributions:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout and setup environment
         uses: MetaMask/action-checkout-and-setup@v1

.github/workflows/check-pr-labels.yml

@@ -17,6 +17,7 @@ concurrency:
 jobs:
   check-pr-labels:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       pull-requests: read
 

.github/workflows/check-release-tag.yml

@@ -17,6 +17,7 @@ jobs:
     # Only run on PRs targeting stable
     if: github.base_ref == 'stable'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       pull-requests: read

.github/workflows/check-template-and-add-labels.yml

@@ -10,6 +10,7 @@ on:
 jobs:
   check-template-and-add-labels:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: ${{ github.event_name != 'merge_group' }} # Skip this step for merge_group events
     steps:
       - name: Checkout and setup environment

.github/workflows/cla.yml

@@ -13,6 +13,7 @@ jobs:
   CLABot:
     if: github.event_name == 'pull_request_target' || contains(github.event.comment.html_url, '/pull/')
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       pull-requests: write
       contents: write

.github/workflows/close-bug-report.yml

@@ -10,6 +10,7 @@ on:
 jobs:
   close-bug-report:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: github.event.pull_request.merged == true && ( startsWith(github.event.pull_request.head.ref, 'Version-v') || startsWith(github.event.pull_request.head.ref, 'release/') )
     steps:
       - name: Checkout and setup environment