ci(pact): use $GITHUB_SHA env var, add concurrency + timeout

Review round 1 follow-ups:
- Reference the built-in $GITHUB_SHA env var in run scripts instead of
  interpolating ${{ github.sha }}, removing the GitHub Actions script-injection
  surface (SonarCloud security rating on new code).
- Add a concurrency group (cancel-in-progress: false) to
  pact-record-deployment.yml so back-to-back tag pushes don't race the recording.
- Add timeout-minutes: 5 to guard against a hung tailnet join.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pact.yml

@@ -166,7 +166,7 @@ jobs:
             --broker-username "$PACT_USERNAME" \
             --broker-password "$PACT_PASSWORD" \
             --pacticipant nextcloud-mcp-server \
-            --version "${{ github.sha }}" \
+            --version "$GITHUB_SHA" \
             --to-environment production
           rc=$?
           if [ "$rc" -ne 0 ]; then