chore: add concurrency guards and pin zizmor in CI

[anevolbap]

Part of a deeper hardening pass over CI, pre-commit, packaging and pinning, done with Opus 5.

Three small things. ci.yml and zizmor.yml have no concurrency block, so pushing three times to a PR runs three full matrices to completion. uvx zizmor is unpinned, so a new upstream audit can turn CI red on a branch nobody touched. And the test job has no timeout-minutes, so a wedged doctest holds a runner for six hours.

Cancellation is limited to pull request builds, matching release.yml. A push to main finishes, so the commit keeps its Codecov report and its code scanning results.

Rationale for each change is inline on the diff.

On the timeout

An earlier revision of this PR left the timeout out, on the grounds that #1119 had already fixed it. That was wrong for this branch. #1119 landed on the integration branch, so main has neither the guard nor the doctest sampling fix behind it. This PR's own test (3.11) job then wedged in Run doctests and was cancelled at the 6 hour ceiling, the third occurrence of #1117 after the two on #1087. The cap here reuses the wording from #1119 so the two branches converge instead of drifting.

main still carries the root cause. Backporting the doctest sampling fix from #1119 is a separate change.

Deliberately not included

The audit that produced this PR suggested three more changes. Each was dropped after checking, so recording why:

• Moving the numpydoc hook off v1.11.0rc0. That rc came from pre-commit.ci autoupdate picking the newest tag in [pre-commit.ci] pre-commit autoupdate #969, and there is no stable 1.11.0, so pinning back would just be re-bumped next run.
• Skipping the SARIF upload on fork PRs, on the theory that security-events: write is not granted there. Wrong: Fix order-dependent interaction-term lookup in DiD effect_summary #1063 and feat: add power_analysis() with sigmoid fitting strategy (#820) #989 are genuine fork PRs and zizmor passes on both, so upload-sarif already handles the read-only token.
• cache: pip on the notebooks job. Real but marginal: installing takes 75 seconds of a job that spends nine minutes running notebooks.

[anevolbap]

Inline notes on each change, so the body stays short.

[anevolbap]

This workflow triggers on pushes to main and on published releases, and cancelling either part way through is worse than letting a duplicate run finish. The build job still runs on every PR to main, so superseded PR builds are worth cancelling, hence the expression rather than skipping this file.

ci.yml and zizmor.yml now use the same expression for the same reason.

[anevolbap]

1.29.0 is the current release, and what uvx zizmor resolved to when I checked.

The failure mode this prevents is a branch going red without anyone touching it: zizmor ships new audits regularly, and an unpinned uvx picks them up on the next run. Bumping this is then a deliberate, reviewable change, which matches how every uses: line in this repo is already pinned.

Renamed the job above, since "zizmor latest via PyPI" is no longer accurate.

Dependabot cannot see a version inside run:, so this one needs a manual bump. Noted in the step comment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.98%. Comparing base (7e23946) to head (21801f7).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1126   +/-   ##
=======================================
  Coverage   95.98%   95.98%           
=======================================
  Files         104      104           
  Lines       16277    16277           
  Branches      912      912           
=======================================
  Hits        15623    15623           
  Misses        488      488           
  Partials      166      166           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[anevolbap]

Same group expression test_notebook.yml already uses, so the three behave consistently. Today a PR with three pushes runs three full matrices to completion, and nothing consumes the superseded results.

Cancellation is limited to pull requests, matching release.yml. A push to main finishes, so the commit keeps its Codecov report.

[drbenvincent]

Review

Approving — focused CI hygiene with verified motivation.

What it does:

• Adds PR-scoped concurrency to ci.yml, zizmor.yml, and release.yml so superseded PR builds cancel; main pushes still finish (Codecov + SARIF preserved).
• Pins uvx zizmor@1.29.0 — trades frozen audits for stability on untouched branches; inline comment documents manual bump.
• Adds timeout-minutes: 30 on the test job — backstop for wedged doctests (#1117); run history on this PR shows the first push wedged ~6h before the guard landed.

Checks: CI green on latest head; branch up to date with main.

Non-blocking notes:

• test_notebook.yml still cancels unconditionally — optional consistency follow-up.
• Doctest sampling fix from #1119 on the integration branch is still the root-cause fix for #1117; this timeout is the guard only.
• Trivial comment-only overlap possible when the integration branch merges — values already align at 30 minutes.