msvc build improvements

- add concurrency group to cancel redundant runs
- pin GitHub action versions to full SHA
- add error handling and timeouts to Docker operations
- Classify pull failures: 404=rebuild, auth/registry errors=fail loud
- Add timeouts: pull(10m), build(60m), push(20m), test(120m)
- restrict packages:write permission to non-PR runs
- Remove packages:write from workflow-level permissions
- Add step-level permissions to GHCR login step
- Add condition to skip login for pull requests (including forks)
- Fork PRs now have minimal permissions (contents:read only)

Generated-by: OpenCode big-pickle