fix(deps): clear RUSTSEC-2026-0204, and stop test runs starving the runner pool

Two findings from the release dry run.

RUSTSEC-2026-0204 blocked publish. `crossbeam-epoch 0.9.18` carries an invalid
pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared`. The
dependency gate runs `strict: true` on a release, so this is a hard failure and
the publish job would never have started - correctly. Updated to 0.9.20, the
advisory's stated fix. cargo test --features full: 323 passed, 0 failed.

Two advisories remain as warnings rather than errors and do not block:
RUSTSEC-2024-0388 (`derivative` unmaintained) and RUSTSEC-2026-0190.

tests.yml had no concurrency group. Every push spawned a fresh five-version
matrix and superseded runs kept going, so four pushes in quick succession put
~20 test jobs in the pool at once and starved the release wheels of runners - a
perfectly healthy release run sat at "queued" and a test run looked hung at 7%
when it was simply waiting. One in-flight run per ref now, cancelling the rest.

Deliberately not applied to release-build.yml: cancelling a half-finished
release is worse than paying for it to complete.

Author: Guillaume Lessard

.github/workflows/tests.yml

@@ -7,6 +7,17 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# One in-flight test run per branch or PR. Without this, every push spawns a
+# fresh 5-version matrix and the superseded runs keep going: four pushes in
+# quick succession put ~20 test jobs in the pool at once, which starved the
+# release-build wheels of runners and made a healthy run look hung at 7%.
+#
+# Deliberately NOT applied to release-build.yml: cancelling a half-finished
+# release is worse than paying for it to complete.
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   rust:
     name: Rust tests