harden(ci): concurrency-cancel guard on canonical check workflows (#6)

Redistributes the merged hyperpolymath/standards#122 canonical fix:
adds concurrency{cancel-in-progress:true} to read-only check workflows
(and scopes affinescript-verify push to [main,master]) so re-pushes /
rebased PRs do not pile up queued runs against the shared account-wide
Actions concurrency pool. Read-only checks only; zero coverage lost.

Files: scorecard.yml codeql.yml

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -5,6 +5,14 @@ name: CodeQL Security Analysis
 on:
   workflow_dispatch:  # Manual trigger only
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:

.github/workflows/scorecard.yml

@@ -6,6 +6,14 @@ on:
   schedule:
     - cron: '0 4 * * 0'
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs: