diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f06fe7..3c26eb2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,10 +2,15 @@ name: ci
 
 on:
   pull_request:
+    paths-ignore: ['**.md', 'docs/**', 'specs/**', '.specify/**']
   push:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -13,6 +18,7 @@ jobs:
   test:
     name: test
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -62,6 +68,7 @@ jobs:
   shell-suites:
     name: shell suites
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -87,6 +94,7 @@ jobs:
     # release-range audit separately. These explicit reads are required because
     # a job-level permissions block clears scopes not named here.
     if: github.event_name == 'pull_request'
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
@@ -106,6 +114,7 @@ jobs:
     name: integration tests
     runs-on: ubuntu-latest
     needs: test
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v7
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27112fc..57eeb89 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,7 @@ jobs:
   guard:
     name: release guard
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -69,6 +70,7 @@ jobs:
     name: release verification
     runs-on: ubuntu-latest
     needs: guard
+    timeout-minutes: 15
     steps:
       - name: Checkout tag
         uses: actions/checkout@v7
@@ -127,6 +129,7 @@ jobs:
     name: release shell suites
     runs-on: ubuntu-latest
     needs: guard
+    timeout-minutes: 10
     steps:
       - name: Checkout tag
         uses: actions/checkout@v7
@@ -150,6 +153,7 @@ jobs:
       - guard
       - verify
       - shell-suites
+    timeout-minutes: 15
     steps:
       - name: Checkout tag
         uses: actions/checkout@v7
@@ -171,6 +175,7 @@ jobs:
       - verify
       - shell-suites
       - docker-image
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -211,6 +216,7 @@ jobs:
     needs:
       - guard
       - publish-release
+    timeout-minutes: 15
     steps:
       - name: Checkout tag
         uses: actions/checkout@v7
diff --git a/CHANGELOG.md b/CHANGELOG.md
deleted file mode 100644
index 45a8ea4..0000000
--- a/CHANGELOG.md
+++ /dev/null
@@ -1,13 +0,0 @@
-# Changelog
-
-All notable changes to this project will be generated from Conventional Commits
-by GoReleaser when a `v*` tag is pushed.
-
-## Unreleased
-
-- Add self-update support from GitHub Releases.
-- Bootstrap minimal enterprise-style CLI.
-- Add version output, minimal help, stable exit-code mapping, and global
-  `--no-color`, `--verbose`, and `--quiet` flags.
-- Add CI for formatting, module tidiness, vet, tests, and build.
-- Add tag-driven GoReleaser configuration.