ci: align the pipelines with the hand-written templates

Assisted-by: GLM 5.3 Flash

.gitea/workflows/test.yml

@@ -21,16 +21,22 @@ on:
     branches: [development]
 
 env:
-  # Portable baseline, x86-64-v3 minimum. Other GOARCH values ignore it.
-  GOAMD64: v3
   # One core: parallelism buys no speed here and costs memory the box does not have.
   GOFLAGS: -p=1
   GOMAXPROCS: "2"
 
+# A superseded run of the same ref is cancelled instead of queueing behind one that
+# no longer matters. Verified on Gitea 1.27.1 on 2026-09-17: a queued run whose ref
+# moved on is cancelled before it ever reaches the runner, while a run already
+# dispatched there runs to completion.
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: fedora
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
 
@@ -45,6 +51,11 @@ jobs:
         # no-op where it is already present; drop this step once verified on the box.
         run: dnf install -y perl
 
+      # The steps follow the `gates` order of the justfile contract: build, format,
+      # vet, test. The vet gate is go vet and go fix -diff, two steps here.
+      - name: Build
+        run: go build ./...
+
       - name: Format
         run: |
           perl -e '
@@ -62,14 +73,14 @@ jobs:
         # Exits non-zero when it has something to rewrite, so it needs no output capture.
         run: go fix -diff ./...
 
-      - name: Build
-        run: go build ./...
-
       - name: Tests
-        # The sweep is `packages` in the project's justfile and the floor is computed over
-        # the same product packages as the justfile's `coverpkg`, so the number is the one
-        # `just test` reports locally.
-        run: go test -count=1 -timeout 30m -coverprofile=coverage.out -coverpkg=./arch/...,./asm/...,./ast/...,./disasm/...,./format/...,./lexer/...,./lint/...,./lsp/...,./parser/...,./token/...,./verify/... ./...
+        # The suite must be fast: a push pipeline that cannot finish in a few minutes moves
+        # its heavy part behind a dispatch. The inner timeout matches the job's, so a
+        # hanging test reports its own goroutine dump rather than a silent job kill.
+        # The pattern is `packages` in the project's justfile: the logic packages, since a
+        # thin cmd/ would drag the total under the floor. release.yml runs the same
+        # command, so the floor is the same number everywhere.
+        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
 
       - name: Coverage floor
         run: |