ci: cut Actions burn — scope push triggers + concurrency-cancel (#50)

Scope `push` to default branches (kills push+PR double-runs) and add
`concurrency: cancel-in-progress` to read-only PR-triggered checks. Part
of the estate CI-burn reduction (Actions spending-limit wall). Files
changed: 2. No SPDX/logic changes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/php-security.yml

@@ -1,6 +1,15 @@
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: PHP Security Check
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+# Estate guardrail: scope push to default branches so a PR fires once (not
+# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read

.github/workflows/rescript-deno-ci.yml

@@ -1,6 +1,15 @@
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: ReScript/Deno CI
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+# Estate guardrail: scope push to default branches so a PR fires once (not
+# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read