fix(ci): concurrency dedup + tighten over-broad triggers (Refs #77) (#79)

## What

Cause-B mitigation for the CI jam tracked in #77.

The forensic analysis in #77 identified two contributing causes:
- **Cause A** (parse-time fast-fail of 3 workflows) — fixed in #78.
- **Cause B** — every push fans out 20+ workflows with **zero
concurrency control**, so stacked pushes pile identical jobs into a
queue the saturated personal-account runner pool never drains.

This PR is the tractable code-side mitigation for Cause B.

## Changes (purely additive except 2 trigger narrowings; no gate
disabled)

**Concurrency dedup** — added `concurrency: { group: ${{ github.workflow
}}-${{ github.ref }} }` to every workflow that lacked one
(`hypatia-scan.yml` already had the canonical block). This matches the
repo's own pre-existing idiom.

- `cancel-in-progress: true` for push/PR CI gates: rust-ci, codeql,
governance, mvp-smoke, live-provers, dogfood-gate, cargo-audit,
secret-scanner, security-scan, formal-verification, agda-meta-checker,
idris2-abi-ci, chapel-ci, cflite_pr.
- `cancel-in-progress: false` for mirror / instant-sync / boj-build /
ghcr-publish / scorecard / scorecard-enforcer — these dedupe stacked
runs but an in-flight mirror, publish or security scan is **never**
aborted mid-run.

**Over-broad triggers tightened** (every gate still fires; nothing
disabled):
- `governance.yml`: `pull_request:` was unscoped (fired on PRs to
*every* branch) → `branches: [main, master]`, matching the other gates.
- `container-ci.yml`: `push:` was any-branch (path-filtered only) →
`branches: [main, master]`, so feature-branch pushes touching those
paths no longer also fan out a container build.

## Verification

Each insertion is a syntactically-trivial, correctly-indented top-level
`concurrency:` mapping placed at a verified-safe position, identical in
shape to the repo's existing valid `hypatia-scan.yml`.

## Residual (not fixable in-repo)

The root Cause-B driver — GitHub-hosted Actions concurrency /
spending-limit saturation on the **personal account** — is
org-admin/billing-gated (github.com/settings/billing). This PR removes
the *self-inflicted* fan-out amplification; the account-level cap
remains and is tracked on #77.

Refs #77

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/agda-meta-checker.yml

@@ -15,6 +15,12 @@ on:
       - 'meta-checker/**'
   workflow_dispatch:
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/boj-build.yml

@@ -4,6 +4,13 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
+
+# Cause-B mitigation (#77): de-duplicate stacked BoJ build triggers.
+# cancel-in-progress is false so an in-flight dispatch always completes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest

.github/workflows/cargo-audit.yml

@@ -14,6 +14,12 @@ on:
     # Run weekly on Monday at 06:00 UTC to catch new advisories.
     - cron: '0 6 * * 1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/cflite_pr.yml

@@ -4,6 +4,12 @@ on:
   pull_request:
     branches: [main]
 
+# Cause-B mitigation (#77): cancel superseded fuzzing runs so rapid
+# PR pushes don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/chapel-ci.yml

@@ -19,6 +19,12 @@ on:
       - 'Cargo.toml'
       - '.github/workflows/chapel-ci.yml'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/codeql.yml

@@ -9,6 +9,12 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/container-ci.yml

@@ -13,6 +13,10 @@ name: Container Build Verification
 
 on:
   push:
+    # Cause-B mitigation (#77): was any-branch (path-filtered only);
+    # scoped to integration branches so feature-branch pushes that
+    # touch these paths don't also fan out a container build.
+    branches: [main, master]
     paths:
       - 'Containerfile'
       - '.containerization/**'
@@ -34,6 +38,13 @@ on:
     # so the container build does not race the live-prover tests.
     - cron: '0 6 * * 0'
 
+# Cause-B mitigation (#77): de-duplicate superseded builds on the same
+# ref. cancel-in-progress is false so an in-flight image build/publish
+# is never interrupted mid-push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/dogfood-gate.yml

@@ -12,6 +12,12 @@ on:
   push:
     branches: [main, master]
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/formal-verification.yml

@@ -29,6 +29,12 @@ on:
     paths:
       - 'crates/echidna-core-spark/**'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/ghcr-publish.yml

@@ -9,6 +9,12 @@ on:
     types: [published]
   workflow_dispatch:
 
+# Cause-B mitigation (#77): de-duplicate stacked publish runs.
+# cancel-in-progress is false — never abort an image publish in flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}