ci(pact): use $GITHUB_SHA env var, add concurrency + timeout

Review round 1 follow-ups:
- Reference the built-in $GITHUB_SHA env var in run scripts instead of
  interpolating ${{ github.sha }}, removing the GitHub Actions script-injection
  surface (SonarCloud security rating on new code).
- Add a concurrency group (cancel-in-progress: false) to
  pact-record-deployment.yml so back-to-back tag pushes don't race the recording.
- Add timeout-minutes: 5 to guard against a hung tailnet join.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pact-record-deployment.yml

@@ -31,6 +31,12 @@ on:
 permissions:
   contents: read
 
+# A re-tag (e.g. after a botched release) could push the same/overlapping tag
+# twice; don't cancel an in-flight recording — let it complete.
+concurrency:
+  group: pact-record-deployment-${{ github.ref }}
+  cancel-in-progress: false
+
 env:
   PACT_BROKER: ${{ secrets.PACT_BROKER }}
   PACT_USERNAME: ${{ secrets.PACT_USERNAME }}
@@ -40,6 +46,7 @@ jobs:
   record-deployment:
     name: Record production deployment
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Join tailnet
         if: ${{ env.PACT_BROKER != '' }}
@@ -63,5 +70,5 @@ jobs:
             --broker-username "$PACT_USERNAME" \
             --broker-password "$PACT_PASSWORD" \
             --pacticipant nextcloud-mcp-server \
-            --version "${{ github.sha }}" \
+            --version "$GITHUB_SHA" \
             --environment production

.github/workflows/pact.yml

@@ -166,7 +166,7 @@ jobs:
             --broker-username "$PACT_USERNAME" \
             --broker-password "$PACT_PASSWORD" \
             --pacticipant nextcloud-mcp-server \
-            --version "${{ github.sha }}" \
+            --version "$GITHUB_SHA" \
             --to-environment production
           rc=$?
           if [ "$rc" -ne 0 ]; then