fix: restore safety-net defaults for build config zero values

Restore the safety-net checks that prevent zero values for
MaxConcurrentBuilds and DefaultTimeout from reaching the build manager.
These were removed in f00f60b, but are needed because a user who
explicitly sets build.timeout: 0 or build.max_concurrent_source_builds: 0
in their YAML would get those zero values passed through koanf, bypassing
the defaults. A zero concurrent-builds limit could starve the build queue,
and a zero timeout could expire builds immediately.

Author: cursoragent

lib/providers/providers.go

@@ -288,6 +288,16 @@ func ProvideBuildManager(p *paths.Paths, cfg *config.Config, instanceManager ins
 		RegistrySecret:      cfg.JwtSecret, // Use same secret for registry tokens
 	}
 
+	// Safety-net: ensure critical build config values are never zero, even if
+	// explicitly set to 0 in YAML. A zero concurrent-builds limit would starve
+	// the build queue, and a zero timeout would expire builds immediately.
+	if buildConfig.MaxConcurrentBuilds == 0 {
+		buildConfig.MaxConcurrentBuilds = 2
+	}
+	if buildConfig.DefaultTimeout == 0 {
+		buildConfig.DefaultTimeout = 600
+	}
+
 	// Configure secret provider (use NoOpSecretProvider as fallback to avoid nil panics)
 	var secretProvider builds.SecretProvider
 	if cfg.Build.SecretsDir != "" {