@@ -45,7 +45,9 @@ wait_green() {
 }
 
 # smoke_applies: 0 when some changed file falls outside blender-smoke.yml's
-# paths-ignore ("**.md", "docs/**", "assets/**"). Unreadable file lists count
+# paths-ignore ("**.md", "docs/**", "assets/**", the two plugin manifest dirs,
+# "live-session/**", ".github/ISSUE_TEMPLATE/**"; tests/test_release_gate.py
+# checks the two lists agree). Unreadable file lists count
 # as "applies" so the gate fails toward waiting, not toward skipping. So do
 # lists of 300 or more: the compare and commit APIs return at most 300 files,
 # in path order, so a big docs/gallery regeneration can hide the code change
@@ -61,7 +63,7 @@ smoke_applies() {
   [ "$(printf '%s\n' "$files" | wc -l)" -lt 300 ] || return 0
   while IFS= read -r f; do
     case "$f" in
-      *.md|docs/*|assets/*) ;;
+      *.md|docs/*|assets/*|.claude-plugin/*|.cursor-plugin/*|live-session/*|.github/ISSUE_TEMPLATE/*) ;;
       *) return 0 ;;
     esac
   done <<< "$files"
 
@@ -45,6 +45,10 @@ on:
       - "**.md"
       - "docs/**"
       - "assets/**"
+      - ".claude-plugin/**"
+      - ".cursor-plugin/**"
+      - "live-session/**"
+      - ".github/ISSUE_TEMPLATE/**"
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened, labeled]
@@ -54,6 +58,10 @@ on:
       - "**.md"
       - "docs/**"
       - "assets/**"
+      - ".claude-plugin/**"
+      - ".cursor-plugin/**"
+      - "live-session/**"
+      - ".github/ISSUE_TEMPLATE/**"
 
 permissions:
   contents: read
@@ -70,6 +78,7 @@ jobs:
   resolve-matrix:
     name: Resolve smoke matrix
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     if: github.event.action != 'labeled' || github.event.label.name == 'needs-5.1'
     outputs:
       series: ${{ steps.set.outputs.series }}
 
@@ -11,6 +11,7 @@ jobs:
   drift-check:
     name: Ecosystem drift check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
 
@@ -17,6 +17,7 @@ jobs:
     # cosmetic. No checkout: every step talks to the API only.
     if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
       GH_REPO: ${{ github.repository }}
     steps:
 
@@ -42,12 +42,15 @@ jobs:
   # release fails, redeploy by hand: Actions > Deploy GitHub Pages > Run workflow.
   gate:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       deploy: ${{ steps.decide.outputs.deploy }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          sparse-checkout: .github/scripts
+          sparse-checkout: |
+            .github/scripts
+            scripts/build_plugin_dist.py
       - id: decide
         env:
           EVENT: ${{ github.event_name }}
@@ -59,6 +62,22 @@ jobs:
               | bash .github/scripts/bump-kind.sh)" != "none" ]; then
             deploy=false
             echo "Release-worthy push: release.yml dispatches Pages after the version bump."
+          elif [ "$EVENT" = "push" ]; then
+            # A push that touches plugin content also releases (a patch, #350),
+            # and that release dispatches Pages too, so deploying here would be
+            # the duplicate (#495). Shipped paths come from the dist build.
+            shipped=$(python3 scripts/build_plugin_dist.py --list-paths)
+            while IFS= read -r f; do
+              f="${f%$'\r'}"
+              while IFS= read -r p; do
+                p="${p%$'\r'}"
+                case "$f" in "$p"|"$p"/*)
+                  deploy=false
+                  echo "Plugin content changed ($f): release.yml dispatches Pages after the patch release." ;;
+                esac
+              done <<< "$shipped"
+              [ "$deploy" = false ] && break
+            done < <(echo "$COMMITS" | jq -r '.[] | (.added + .modified + .removed)[]')
           fi
           echo "deploy=$deploy" >> "$GITHUB_OUTPUT"
           echo "deploy=$deploy"
@@ -70,6 +89,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
 
@@ -20,6 +20,7 @@ jobs:
     # also waits for its own Blender Smoke push run, unless it changed only
     # smoke-ignored paths (see release-gate.sh).
     runs-on: ubuntu-latest
+    timeout-minutes: 125
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     permissions:
       contents: read
@@ -41,6 +42,7 @@ jobs:
     name: Bump version, tag, and release
     needs: gate
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     permissions:
       contents: write
 
@@ -12,6 +12,7 @@ permissions:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
 
@@ -13,8 +13,12 @@ jobs:
   validate:
     name: Validate structure and frontmatter
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"  # pinned: the runner image's python3 moves (#495)
 
       - name: Check referenced paths exist
         run: |
@@ -137,6 +141,7 @@ jobs:
     # The landing page is built only at deploy (docs/index.html is untracked),
     # so a template error or a dead link otherwise surfaces in production.
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -160,8 +165,12 @@ jobs:
   validate-manifest:
     name: Validate plugin manifest
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"  # pinned: the runner image's python3 moves (#495)
 
       - name: Check plugin.json matches filesystem and VERSION
         run: |
@@ -258,8 +267,12 @@ jobs:
   validate-claude-packaging:
     name: Validate Claude Code packaging
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"  # pinned: the runner image's python3 moves (#495)
 
       - name: Check .claude-plugin manifests match VERSION and the skills on disk
         run: |
@@ -363,8 +376,12 @@ jobs:
   validate-counts:
     name: Validate content counts
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"  # pinned: the runner image's python3 moves (#495)
 
       - name: Check content counts match the repo
         env:
@@ -436,8 +453,15 @@ jobs:
   validate-harness:
     name: Validate smoke harness protocol
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"  # pinned: the runner image's python3 moves (#495)
+
+      - name: Install pinned dev requirements (the release-gate mirror test reads YAML)
+        run: pip install -r requirements-dev.txt
 
       - name: Harness unit tests
         run: python3 tests/smoke/test_harness.py -v
@@ -464,6 +488,4 @@ jobs:
         run: python3 tests/test_falsifier_shard.py -v
 
       - name: Hero-drift tool exit-code tests
-        run: |
-          pip install -r requirements-dev.txt
-          python3 tests/test_measure_hero_drift.py -v
+        run: python3 tests/test_measure_hero_drift.py -v
@@ -86,6 +86,30 @@ def test_docs_only_direct_push_skips_smoke(self):
         self.assertEqual(code, 0, out)
         self.assertIn("only smoke-ignored paths", out)
 
+    def test_manifest_and_mcp_only_direct_push_skips_smoke(self):
+        # #495: a manifest or live-session change runs no Blender code.
+        code, out = self.gate(
+            FAKE_PR="", FAKE_SMOKE="none none", SMOKE_TIMEOUT="0",
+            FAKE_FILES=r".claude-plugin/plugin.json\nlive-session/mcp.json\n.github/ISSUE_TEMPLATE/bug.yml",
+        )
+        self.assertEqual(code, 0, out)
+        self.assertIn("only smoke-ignored paths", out)
+
+    def test_gate_mirrors_smoke_paths_ignore(self):
+        # release-gate.sh decides "no smoke run to wait for" from its own copy
+        # of blender-smoke.yml's paths-ignore; the two must not drift.
+        import re
+        import yaml
+        wf = yaml.safe_load((REPO / ".github" / "workflows" / "blender-smoke.yml")
+                            .read_text(encoding="utf-8"))
+        on = wf.get("on", wf.get(True))
+        for event in ("push", "pull_request"):
+            globs = on[event]["paths-ignore"]
+            want = {g.replace("**.", "*.").replace("/**", "/*") for g in globs}
+            case = re.search(r"^\s*([^\n]*\*\.md\|[^\n]*)\) ;;", GATE.read_text(encoding="utf-8"), re.M)
+            self.assertIsNotNone(case, "release-gate.sh smoke-ignored case line not found")
+            self.assertEqual(set(case.group(1).split("|")), want, event)
+
     def test_truncated_file_list_waits_for_smoke(self):
         # 300 docs paths is the API's cap: a code change may sort after them.
         many = r"\n".join(f"docs/gallery/p{i:03d}.html" for i in range(300))