Release workflows should scope permissions, concurrency, and timeouts explicitly

[Widthdom]

Problem

Release-related workflows can be made more robust by scoping privileges and runtime bounds explicitly.

Evidence

• .github/workflows/release.yml grants top-level contents: write, id-token: write, and attestations: write for the workflow, while some jobs only need read permissions.
• No release concurrency group is configured, so tag/manual release jobs can overlap.
• timeout-minutes appears only in mutation-testing.yml; release and build workflows rely on defaults.
• Several curl retry/probe loops do not specify curl-level timeout flags.

Expected behavior

Move permissions to the narrowest job scope, add a release concurrency group keyed by tag/ref, and give long-running jobs/network probes explicit timeouts.

Labels

bug, security, github_actions

[Widthdom]

Work started on branch fix-issue3485-3486-3487-3489-3490-3491-3508.