chore(ci): optimise GitHub workflows

Add concurrency (PR-cancel only), dependency caching, timeouts, and
path filters across all four workflows. Pin opencode action to v1.17.7
and tighten the /oc trigger. Skip MQTT broker rebuild when upstream
SHA is unchanged. Gate sdist/wheel build job to main-only pushes.

.github/workflows/opencode.yml

@@ -6,17 +6,28 @@ on:
   pull_request_review_comment:
     types: [created]
 
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+  id-token: write
+
+concurrency:
+  group: opencode-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: false
+
 jobs:
   opencode:
     if: |
       (contains(github.event.comment.author_association, 'OWNER') ||
        contains(github.event.comment.author_association, 'MEMBER') ||
        contains(github.event.comment.author_association, 'COLLABORATOR')) &&
-      (contains(github.event.comment.body, ' /oc') ||
-       startsWith(github.event.comment.body, '/oc') ||
-       contains(github.event.comment.body, ' /opencode') ||
-       startsWith(github.event.comment.body, '/opencode'))
+      (startsWith(github.event.comment.body, '/oc') ||
+       contains(github.event.comment.body, '\n/oc') ||
+       startsWith(github.event.comment.body, '/opencode') ||
+       contains(github.event.comment.body, '\n/opencode'))
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       id-token: write
       contents: read
@@ -29,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Run opencode
-        uses: anomalyco/opencode/github@latest
+        uses: anomalyco/opencode/github@v1.17.7
         env:
           ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
         with: