ci: add concurrency blocks to 5 read-only workflows + drop dead master triggers (#379)

## Summary

Five workflows in this repo run on every PR push but lack a
\`concurrency:\` block. When a contributor force-pushes or rapid-pushes
to a PR branch, each new push spawns a fresh run while the previous one
keeps consuming a runner slot — they pile up and serialise rather than
the new run cancelling the stale one.

The repo already has the canonical pattern in \`codeql.yml\`,
\`governance.yml\`, \`hypatia-scan.yml\`, \`panic-attack.yml\`, and
\`scorecard-enforcer.yml\`:

\`\`\`yaml
concurrency:
  group: \${{ github.workflow }}-\${{ github.ref }}
  cancel-in-progress: true
\`\`\`

This PR applies the same pattern (with the standard \"read-only check
workflows\" comment) to the five workflows that were missing it:

- \`ci.yml\` — the main OCaml/Deno build job (the highest-leverage of
the five; runs on every PR)
- \`semgrep.yml\` — SAST
- \`stdlib-naming.yml\` — case-collision guard
- \`spark-theatre-gate.yml\` — reusable workflow caller
- \`workflow-linter.yml\` — workflow security linter

All five are read-only check workflows (no publish, no mutation), so
\`cancel-in-progress: true\` is always safe — the superseded run was
about to report a stale result anyway.

## Drive-by cleanup

Drop \`master\` from the branch triggers in \`semgrep.yml\` and
\`spark-theatre-gate.yml\`. The repo's default and only long-lived
branch is \`main\`; the \`master\` entries were dead config.

## Test plan

- [ ] CI: all 5 workflows continue to run as before on this PR
- [ ] Visual: each workflow's run page now shows a \"Cancelled\"
superseded run when a follow-up push lands

Refs estate CI hygiene audit 2026-05-26.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/ci.yml

@@ -10,6 +10,12 @@ on:
 permissions:
   contents: read
 
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/semgrep.yml

@@ -3,15 +3,21 @@ name: Semgrep SAST
 
 on:
   push:
-    branches: [main, master]
+    branches: [main]
   pull_request:
-    branches: [main, master]
+    branches: [main]
   schedule:
     - cron: '0 5 * * 1'
   workflow_dispatch:
 
 permissions: read-all
 
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   semgrep:
     runs-on: ubuntu-latest

.github/workflows/spark-theatre-gate.yml

@@ -8,11 +8,17 @@ name: SPARK Theatre Gate
 on:
   pull_request:
   push:
-    branches: [main, master]
+    branches: [main]
 
 permissions:
   contents: read
 
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   spark-theatre-gate:
     uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@462003782f3ebb93ea763e81d0d199ce13ef7d73

.github/workflows/stdlib-naming.yml

@@ -20,6 +20,12 @@ on:
 permissions:
   contents: read
 
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   enforce-lowercase-stdlib:
     runs-on: ubuntu-latest

.github/workflows/workflow-linter.yml

@@ -12,6 +12,12 @@ on:
 
 permissions: read-all
 
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-workflows:
     runs-on: ubuntu-latest