fix(mcp): add HTTP client timeout and harden workflow limits

.github/workflows/ci.yml

@@ -10,6 +10,7 @@ jobs:
   smoke:
     name: Smoke (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -57,6 +58,7 @@ jobs:
   performance:
     name: Performance Smoke
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout
@@ -87,6 +89,7 @@ jobs:
   security:
     name: Security & code health
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout

.github/workflows/release-artifacts.yml

@@ -11,10 +11,15 @@ on:
     tags:
       - 'v*'
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   package:
     name: Package (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     permissions:
       contents: write # create/upload the GitHub Release on a tag push
     strategy:
@@ -112,6 +117,7 @@ jobs:
     needs: package
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     # Manual approval gate: this environment carries a required-reviewer rule
     # (Settings -> Environments -> npm-publish), so the job pauses until a
     # maintainer approves it in the Actions UI before anything reaches npm.

internal/mcp/network_redirect.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"time"
 )
 
 const maxMCPRedirects = 10
@@ -14,6 +15,7 @@ func mcpHTTPClient(server Server, transport http.RoundTripper) *http.Client {
 	return &http.Client{
 		Transport:     transport,
 		CheckRedirect: checkMCPRedirect(server),
+		Timeout:       30 * time.Second,
 	}
 }