CI: standardize Actions (paths + concurrency + runners)

[0xLeif]

Summary

• test.yml: add a bun-ts paths: filter to push/pull_request (src/**, test/**, hooks/**, migrations/**, package.json, tsconfig.json, .github/workflows/test.yml) so README/docs/spec-only edits no longer trigger CI.
• test.yml: add concurrency: ci-${{ github.ref }} with cancel-in-progress: true.
• test.yml: bump actions/checkout@v4 -> @v5 and add timeout-minutes: 15.
• Runner left as ubuntu-latest (PUBLIC repo -> GitHub-hosted only; correct for bun-ts).
• Kept plain bun install (no --frozen-lockfile): bun.lock is gitignored and not committed, so a frozen install would fail CI.
• pages.yml already has a docs-scoped paths: filter, concurrency, and a GitHub-hosted runner; left unchanged.

Mirrors the CorvidLabs/merlin CI standard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.