harden(ci): estate-wide concurrency-cancel guard + scope affinescript-verify push (#122)

## Why

Root-cause follow-up to echo-types#62. `echo-types` (and the estate) is
public, so Actions minutes are free/unlimited — the repo-wide
`queued`/no-progress stalls are **shared account-wide
concurrent-job-slot** exhaustion. These canonical templates propagate
estate-wide, so the fix belongs here, not per-repo.

## Changes
- **+`concurrency{cancel-in-progress:true}`** on 10 read-only check
templates that lacked it: `scorecard`, `scorecard-enforcer`,
`governance`, `codeql`, `language-policy`, `makefile-blocker`,
`secret-scanner`, `doc-format`, `echidna-verify`, `affinescript-verify`.
All read-only (no publish/mutation) → cancelling a superseded run is
always safe.
- **`affinescript-verify.yml`**: `on: [push, pull_request]` → push
scoped to `[main, master]` (PR trigger still covers feature branches).
This was the estate-wide twin of the `agda.yml` `"**"`-push storm: a
full AffineScript verify on every WIP push to every branch in every
consumer repo. **Zero verify coverage lost.**
- **Untouched by design**: `mirror` / `instant-sync` / `boj-build`
(publish/sync/build — mid-cancel unsafe); `hypatia-scan` /
`casket-pages` (already guarded).

All 10 changed files YAML-validated.

## Follow-on (not in this PR)
Landing this fixes the canonical source; consumer repos still carry
stale copies until a sweep redistributes them (verisimiser#59-style
rollout). Recommend that sweep as the closing step once this merges.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/affinescript-verify.yml

@@ -1,6 +1,22 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
 name: AffineScript Verify
-on: [push, pull_request]
+# Direct pushes only on integration branches. Feature-branch validation
+# is fully covered by pull_request — running a full AffineScript verify
+# on every WIP push to every branch in every consumer repo was a dominant
+# estate-wide drain on the shared Actions concurrency pool. No coverage
+# is lost: PRs and post-merge main/master still verify.
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read

.github/workflows/codeql.yml

@@ -9,6 +9,14 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/doc-format.yml

@@ -7,6 +7,14 @@ on:
   pull_request:
     branches: [main, master]
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/echidna-verify.yml

@@ -29,6 +29,14 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/governance.yml

@@ -18,6 +18,14 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/language-policy.yml

@@ -7,6 +7,14 @@ on:
   pull_request:
     branches: [main, master]
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/makefile-blocker.yml

@@ -13,6 +13,14 @@ on:
       - '**/Makefile.*'
       - '**/*.mk'
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/scorecard-enforcer.yml

@@ -9,6 +9,14 @@ on:
     - cron: '0 6 * * 1'  # Weekly on Monday
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/scorecard.yml

@@ -7,6 +7,14 @@ on:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/secret-scanner.yml

@@ -7,6 +7,14 @@ on:
   push:
     branches: [main]
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -70,4 +78,4 @@ jobs:
           if [ $found -eq 1 ]; then
             echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
             exit 1
-          fi
+          fi