ci: enforce release-job timeouts and add workflow lint

.github/workflows/actionlint.yml

@@ -0,0 +1,26 @@
+name: Actionlint
+
+on:
+  workflow_call:
+  push:
+    branches: ["main"]
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    branches: ["main"]
+    paths:
+      - ".github/workflows/**"
+
+jobs:
+  actionlint:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12

.github/workflows/release-plz-crates.yml

@@ -16,6 +16,9 @@ on:
       cargo-registry-token:
         description: Optional crates.io token passed by callers without a release environment secret
         required: false
+      CARGO_REGISTRY_TOKEN:
+        description: Crates.io token resolved from the release environment, preferred over cargo-registry-token
+        required: false
 
 jobs:
   package-preflight:
@@ -43,11 +46,11 @@ jobs:
       releases: ${{ steps.release-plz.outputs.releases }}
       releases_created: ${{ steps.release-plz.outputs.releases_created }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     environment: release
     concurrency:
       group: wrightkit-release-plz-publication
       cancel-in-progress: false
-      queue: max
     permissions:
       contents: write
       pull-requests: read
@@ -74,6 +77,7 @@ jobs:
     if: github.repository_owner == 'wrightkit'
     needs: release
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     concurrency:
       group: wrightkit-release-plz-pr-${{ github.ref }}
       cancel-in-progress: false

docs/ci-platform.md

@@ -24,7 +24,8 @@ change reaches every repository without a pin bump; the workflow's inputs and
 outputs are the compatibility surface, and a breaking change updates its callers
 in the same rollout. Every third-party action is pinned to a full commit SHA,
 because it runs with the caller's credentials and a moved tag or branch would
-change what executes without a review.
+change what executes without a review. GitHub-owned `actions/*` actions count
+as third-party for this mandate: their tags move the same way.
 
 Callers pass only declared inputs and explicitly named secrets; they must not use
 arbitrary command hooks or `secrets: inherit` for the crate release workflow.