ci: make race testing a single release gate

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/release.yml

@@ -22,22 +22,29 @@ on:
 permissions:
   contents: write
 
-# A release is not made irrelevant by a newer one — let it finish.
+# A corrective tag supersedes a release still in flight. Keep the publisher on
+# the newest immutable version instead of running obsolete tags in parallel.
 concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
+  group: release-${{ github.repository }}
+  cancel-in-progress: true
 
 jobs:
   verify:
     runs-on: [lux-build-linux-amd64]
     timeout-minutes: 30
+    env:
+      GOWORK: off
+      CGO_ENABLED: '0'
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
           cache: true
-      - run: go test -race -timeout=40m ./...
+      # CI owns the expensive race gate for this commit. Repeating it here made
+      # two 18-minute crypto suites contend on shared runners and could exceed
+      # this job's 30-minute limit. Release still tests the exact tagged tree.
+      - run: go test -timeout=20m ./... -count=1
 
   build:
     needs: verify