CI: standardize Actions (paths + concurrency + runners)

[0xLeif]

Summary

• ci.yml: added paths: filter (src/**, tests/**, benches/**, build.rs, Cargo.toml, .github/workflows/ci.yml) so README/docs-only changes no longer trigger the 3-OS cargo matrix + clippy/fmt. (Cargo.lock omitted — it is gitignored in this repo.)
• ci.yml: added concurrency: group (${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: true) to cancel redundant runs.
• ci.yml: added timeout-minutes to both jobs. Runner matrix (ubuntu/macos/windows-latest, all GitHub-hosted) is already correct for a PUBLIC repo and left unchanged.
• pages.yml: already site-scoped (docs/**) with concurrency + ubuntu-latest; bumped checkout to @v5 and added timeout-minutes.
• release.yml: tag-push workflow (v*) — no paths: added per standard; GitHub-hosted matrix correct for PUBLIC. Bumped checkout to @v5 and added timeout-minutes.
• All workflows pin actions/checkout@v5.

Validated with python3 -c "yaml.safe_load(...)" and actionlint (exit 0) on all three files.

Mirrors the CorvidLabs/merlin CI standard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.