CI: standardize Actions (paths + concurrency + runners)

[0xLeif]

Summary

• ci.yml: added paths: filter to push/PR triggers (bin/**, .github/workflows/ci.yml) so README/docs/LICENSE-only edits no longer trigger CI.
• ci.yml: added a concurrency: group (ci-${{ github.ref }}) with cancel-in-progress: true.
• ci.yml: bumped actions/checkout@v4 → @v5 and added timeout-minutes: 10 to both jobs. Runner stays ubuntu-latest (correct for this PUBLIC repo).
• pages.yml: already path-scoped to docs/** with concurrency and ubuntu-latest; bumped checkout to @v5 and added timeout-minutes: 10. No paths/runner changes needed.

Notes

• Build system is shell (bin/jwt); fledge.toml has no active tasks, so CI keeps native shellcheck + --help smoke checks rather than fledge run.

Mirrors the CorvidLabs/merlin CI standard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.