[Repo Assist] ci: add concurrency control, job timeout, and guard NuGet login step

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Three small, independent CI improvements to dotnet.yml:

1. Concurrency control

Adds a concurrency group so that when new commits are pushed to a PR branch, the in-progress CI run for that PR is cancelled. Push runs on non-PR branches are not affected (cancel-in-progress is scoped to pull_request events). This saves CI minutes and ensures developers always see results for their latest commit.

2. Job timeout

Adds timeout-minutes: 30 to the build job. The full pipeline (format check → build → .NET tests → Fable tests → docs) currently takes ~15 minutes. A 30-minute ceiling protects against rare runaway scenarios (hung test, infinite loop in a Fable step) that would otherwise occupy a runner for the default 6-hour limit.

3. Guard the NuGet login step

The NuGet/login step previously ran on every build, including PRs from forks. On fork PRs, GitHub restricts the id-token: write permission for security, so the OIDC token is unavailable and the step fails — breaking the entire run for external contributors. The Publish NuGet step already had the correct condition; this PR applies the same guard to Obtain NuGet key.

Test Status

No code changes — CI-only. These changes will take effect on the next run after merge.

Relates to #152 indirectly (cleaner CI helps contributors iterate faster).

Generated by Repo Assist · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@346204513ecfa08b81566450d7d599556807389f

[!WARNING]
🛡️ Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files: .github/workflows/dotnet.yml.

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission. A human must create the pull request manually.

To create a pull request with the changes:

# Download the patch from the workflow run
gh run download 22981588068 -n agent-artifacts -D /tmp/agent-artifacts-22981588068

# Create a new branch
git checkout -b repo-assist/eng-ci-improvements-2026-03-14-472d679e8736afe7 master

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-artifacts-22981588068/aw-repo-assist-eng-ci-improvements-2026-03-14.patch

# Push the branch and create the pull request
git push origin repo-assist/eng-ci-improvements-2026-03-14-472d679e8736afe7
gh pr create --title '[Repo Assist] ci: add concurrency control, job timeout, and guard NuGet login step' --base master --head repo-assist/eng-ci-improvements-2026-03-14-472d679e8736afe7 --repo fsprojects/FSharpx.Collections

Start with .github/workflows/dotnet.yml and review the build job, its NuGet/login steps, and the pull_request workflow conditions. Confirm the concurrency behavior, 30-minute job limit, and fork-safe NuGet login guard, then verify them on the next CI run.