harden(ci): concurrency-cancel + scope Agda push to integration branches

Cut self-inflicted load on the shared estate Actions concurrency pool
(the cause of repo-wide queued/no-progress stalls — public repo, free
unlimited minutes, so the constraint is concurrent-job slots, not spend):

- agda.yml: add concurrency{cancel-in-progress}; restrict push trigger
  from "**" (every branch) to [main, master]. PRs still run the full
  suite via pull_request, so zero proof coverage is lost; this removes
  the full-build-on-every-WIP-push storm and the push+PR double-fire.
- governance.yml, scorecard.yml: add concurrency{cancel-in-progress}
  (both read-only; safe to cancel superseded runs).
- hypatia-scan.yml already guarded; mirror.yml left (main-only,
  publishing — unsafe to mid-cancel).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/agda.yml

@@ -4,11 +4,24 @@
 name: Agda
 
 on:
+  # Direct pushes only on the integration branches. Feature-branch
+  # validation is fully covered by the pull_request trigger below —
+  # gating WIP pushes to no-PR branches with a full multi-minute Agda
+  # build was the dominant self-inflicted load on the shared estate
+  # Actions concurrency pool, and also double-fired (push + PR) on PR
+  # branches. No proof coverage is lost: PRs and post-merge main still
+  # run the full suite.
   push:
-    branches:
-      - "**"
+    branches: [main, master]
   pull_request:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates don't pile up queued full-suite builds. Safe here — this
+# workflow only typechecks (read-only, no publish or mutation).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/governance.yml

@@ -18,6 +18,13 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates don't pile up queued runs. Safe — governance is read-only
+# policy linting with no publish or mutation.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/scorecard.yml

@@ -7,6 +7,13 @@ on:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes don't pile up
+# queued analyses. Safe — Scorecard is read-only supply-chain analysis
+# with no publish or mutation (SARIF upload is idempotent).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read