fix(ci): concurrency dedup + tighten over-broad triggers (Refs #77)

.github/workflows/agda-meta-checker.yml

@@ -15,6 +15,12 @@ on:
       - 'meta-checker/**'
   workflow_dispatch:
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/boj-build.yml

@@ -4,6 +4,13 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
+
+# Cause-B mitigation (#77): de-duplicate stacked BoJ build triggers.
+# cancel-in-progress is false so an in-flight dispatch always completes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest

.github/workflows/cargo-audit.yml

@@ -14,6 +14,12 @@ on:
     # Run weekly on Monday at 06:00 UTC to catch new advisories.
     - cron: '0 6 * * 1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/cflite_pr.yml

@@ -4,6 +4,12 @@ on:
   pull_request:
     branches: [main]
 
+# Cause-B mitigation (#77): cancel superseded fuzzing runs so rapid
+# PR pushes don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/chapel-ci.yml

@@ -19,6 +19,12 @@ on:
       - 'Cargo.toml'
       - '.github/workflows/chapel-ci.yml'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/codeql.yml

@@ -9,6 +9,12 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/container-ci.yml

@@ -13,6 +13,10 @@ name: Container Build Verification
 
 on:
   push:
+    # Cause-B mitigation (#77): was any-branch (path-filtered only);
+    # scoped to integration branches so feature-branch pushes that
+    # touch these paths don't also fan out a container build.
+    branches: [main, master]
     paths:
       - 'Containerfile'
       - '.containerization/**'
@@ -34,6 +38,13 @@ on:
     # so the container build does not race the live-prover tests.
     - cron: '0 6 * * 0'
 
+# Cause-B mitigation (#77): de-duplicate superseded builds on the same
+# ref. cancel-in-progress is false so an in-flight image build/publish
+# is never interrupted mid-push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/dogfood-gate.yml

@@ -12,6 +12,12 @@ on:
   push:
     branches: [main, master]
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/formal-verification.yml

@@ -29,6 +29,12 @@ on:
     paths:
       - 'crates/echidna-core-spark/**'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/ghcr-publish.yml

@@ -9,6 +9,12 @@ on:
     types: [published]
   workflow_dispatch:
 
+# Cause-B mitigation (#77): de-duplicate stacked publish runs.
+# cancel-in-progress is false — never abort an image publish in flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}

.github/workflows/governance.yml

@@ -16,8 +16,17 @@ on:
   push:
     branches: [main, master]
   pull_request:
+    # Cause-B mitigation (#77): was unscoped (fired on PRs to every
+    # branch); narrowed to integration branches like the other gates.
+    branches: [main, master]
   workflow_dispatch:
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/idris2-abi-ci.yml

@@ -11,6 +11,12 @@ on:
       - 'src/abi/**'
       - '.github/workflows/idris2-abi-ci.yml'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/instant-sync.yml

@@ -8,6 +8,12 @@ on:
   release:
     types: [published]
 
+# Cause-B mitigation (#77): de-duplicate stacked sync runs.
+# cancel-in-progress is false so an in-flight sync always completes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/live-provers.yml

@@ -33,6 +33,12 @@ on:
         required: false
         default: '1'
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/mirror.yml

@@ -7,6 +7,13 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# Cause-B mitigation (#77): de-duplicate stacked mirror runs.
+# cancel-in-progress is false so an in-flight mirror push always
+# completes (a half-cancelled mirror could leave the remote stale).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/mvp-smoke.yml

@@ -7,6 +7,12 @@ on:
   pull_request:
     branches: [main]
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/rust-ci.yml

@@ -7,6 +7,12 @@ on:
   pull_request:
     branches: [main]
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/scorecard-enforcer.yml

@@ -9,6 +9,12 @@ on:
     - cron: '0 6 * * 1'  # Weekly on Monday
   workflow_dispatch:
 
+# Cause-B mitigation (#77): de-duplicate stacked enforcer runs.
+# cancel-in-progress is false — never abort a governance gate in flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/scorecard.yml

@@ -6,6 +6,12 @@ on:
   schedule:
     - cron: '0 4 * * *'
 
+# Cause-B mitigation (#77): de-duplicate stacked scorecard runs.
+# cancel-in-progress is false — never abort a security scan in flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/secret-scanner.yml

@@ -7,6 +7,12 @@ on:
   push:
     branches: [main]
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/security-scan.yml

@@ -9,6 +9,12 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
   workflow_dispatch:
 
+# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
+# to the same ref don't pile up identical jobs in the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read