- Reconcile concurrency limits: prConcurrentLimit 50 -> 10 and
branchConcurrentLimit 5 -> 10 (every PR needs a branch, so the old 5 capped
effective PRs and made 50 meaningless).
- Let vulnerability updates bypass the weekday schedule
(vulnerabilityAlerts.schedule = at any time) so weekend CVE fixes are not
held until Monday.
- Add minimumReleaseAge = 3 days so a release ages before it is opened or
automerged (guards against broken/yanked releases).
- Drop redundant assignees (same single user as reviewers) -- noise on every
PR, including auto-merged ones.
Closes#46Closes#47Closes#48Closes#49