chore(ci): raise the test hook timeout, fail an empty backup

PGlite start-up alone takes about seven seconds on an ARM host, so the
10s beforeAll default failed whole files at random. The weekly backup
fails instead of uploading an empty export, and both workflows run with
read-only permissions; CI cancels superseded runs.

.github/workflows/ci.yml

@@ -8,6 +8,14 @@ on:
     branches: [main, dev]
   pull_request:
 
+permissions:
+  contents: read
+
+# A newer push to the same branch supersedes the run still going.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/leaderboard-backup.yml

@@ -1,10 +1,14 @@
 # Weekly copy of every leaderboard, kept as a workflow artifact for 90 days.
 # Upstash's free plan has no scheduled backups, and the boards are the only
-# player data the game holds. Needs three repository secrets: the Redis pair
-# the app reads, KV_REST_API_URL and KV_REST_API_TOKEN (plus KEY_PREFIX if the
-# deployment sets one), and BACKUP_PASSPHRASE. The file is encrypted with the
-# passphrase before upload: on a public repository any signed-in GitHub user
-# can download an artifact, and the boards list every player name.
+# player data the game holds. Needs the repository secrets KV_REST_API_URL,
+# KV_REST_API_TOKEN and BACKUP_PASSPHRASE, plus KEY_PREFIX if the deployment
+# sets one. Only the KV_* names are passed through, not UPSTASH_REDIS_REST_*.
+# An export that finds no boards fails the job rather than uploading an empty
+# file. GitHub disables scheduled workflows after 60 days without repository
+# activity; re-enable it from the Actions tab if it goes quiet. The file is
+# encrypted with the passphrase before upload: on a public repository any
+# signed-in GitHub user can download an artifact, and the boards list every
+# player name.
 # Restore with: openssl enc -d -aes-256-cbc -pbkdf2 -in <file>.enc -out <file>
 name: Leaderboard backup
 
@@ -13,6 +17,9 @@ on:
     - cron: '17 3 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   export:
     runs-on: ubuntu-latest