ci: give the test job the time the race detector actually needs

`test` has been failing on:

    FAIL github.com/luxfi/consensus/protocol/quasar  900.063s

That was never a hang. protocol/quasar is 11601 tests built on SLH-DSA
(FIPS 205 at ParamsM192s, the small-signature set), and the race detector
multiplies it. Measured on one host, -count=1, with the fixture caching
already in place:

    no -race      50.5s
    -race       1105.1s   ALL PASS, coverage 85.5% of statements

900s simply sat below the work, so the binary was killed mid-run and reported
FAIL at exactly 900.0xs — which reads like a deadlock and is not one.

Two cheaper fixes were tried first:

  - Cut the work. Shipped: 3a6fb954 and 760ac03c cache the two SLH-DSA
    fixtures the package rebuilt 7 and 12 times, taking it from ~117s to 50.5s
    un-raced. Real, and not nearly enough against a ~22x multiplier.
  - Skip the crypto under -race, using the package's own raceEnabled const.
    Rejected on measurement: it bought nothing, because the detector taxes all
    11601 tests rather than just those fixtures. It would also have been the
    wrong trade — CI runs ONLY the -race invocation, so skipping there means
    the FIPS-205 cert path is never exercised in CI at all, and this package
    has genuine concurrency (TestGroupedEpochManager_ParallelKeygen) that the
    detector must keep seeing.

So the cap moves instead, and both caps have to: `timeout-minutes: 30` on the
job is the real ceiling, and raising -timeout alone would have changed nothing.
40m/60m is ~2x the measured 1105s, leaving room for CI hardware slower than
the host this was measured on.

release.yml carried the same 15m cap and is raised with it.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/ci.yml

@@ -32,7 +32,7 @@ concurrency:
 jobs:
   test:
     runs-on: [lux-build-linux-amd64]
-    timeout-minutes: 30
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -40,8 +40,21 @@ jobs:
           go-version-file: go.mod
           cache: true
       - run: go mod download
+      # -timeout=40m, not 15m. protocol/quasar is 11601 tests over SLH-DSA
+      # (FIPS 205 at ParamsM192s) and the race detector multiplies it ~22x:
+      # measured on one host, -count=1, with the fixture caching already in
+      #   no -race  50.5s   ->   -race  1105.1s, ALL PASS, 85.5% coverage
+      # It was never a hang. 900s simply sat below the work, so the package
+      # was killed mid-run and reported FAIL at exactly 900.0xs.
+      #
+      # Cutting the work was tried first and is already shipped (5305e785,
+      # 0ba1f553 cache the two SLH-DSA fixtures: ~117s -> 50.5s un-raced).
+      # Skipping the crypto under -race was tried and rejected: it bought
+      # nothing measurable, because the detector taxes all 11601 tests and
+      # not just the fixtures — and this package has real concurrency
+      # (TestGroupedEpochManager_ParallelKeygen) that -race must keep seeing.
       - name: Test
-        run: go test -v -race -timeout=15m -coverprofile=coverage.txt -covermode=atomic ./...
+        run: go test -v -race -timeout=40m -coverprofile=coverage.txt -covermode=atomic ./...
 
   lint:
     runs-on: [lux-build-linux-amd64]

.hanzo/workflows/release.yml

@@ -37,7 +37,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - run: go test -race -timeout=15m ./...
+      - run: go test -race -timeout=40m ./...
 
   build:
     needs: verify