Merge remote-tracking branch 'origin/harden/ci-concurrency-trim-2026-05-18'

Author: hyperpolymath

.github/workflows/agda.yml

@@ -4,11 +4,24 @@
 name: Agda
 
 on:
+  # Direct pushes only on the integration branches. Feature-branch
+  # validation is fully covered by the pull_request trigger below —
+  # gating WIP pushes to no-PR branches with a full multi-minute Agda
+  # build was the dominant self-inflicted load on the shared estate
+  # Actions concurrency pool, and also double-fired (push + PR) on PR
+  # branches. No proof coverage is lost: PRs and post-merge main still
+  # run the full suite.
   push:
-    branches:
-      - "**"
+    branches: [main, master]
   pull_request:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates don't pile up queued full-suite builds. Safe here — this
+# workflow only typechecks (read-only, no publish or mutation).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/governance.yml

@@ -18,6 +18,13 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates don't pile up queued runs. Safe — governance is read-only
+# policy linting with no publish or mutation.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/scorecard.yml

@@ -7,6 +7,13 @@ on:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes don't pile up
+# queued analyses. Safe — Scorecard is read-only supply-chain analysis
+# with no publish or mutation (SARIF upload is idempotent).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read