chore(ci): add concurrency control to all workflows (#200)

Per the org-wide CI concurrency hardening brief — adds a top-level
`concurrency:` block to every workflow under `.github/workflows/`.

Goal: cancel superseded PR runs aggressively while never cancelling
runs on `main`, tags, or scheduled events. Expected impact: 30-40%
reduction in CI compute and clearing of the persistent runner queue
backlog (spar had 21+ jobs queued at brief time, oldest 23h old).

Variants applied:

- `ci.yml` → **default** (group: workflow + head_ref/ref;
  cancel-in-progress conditional on pull_request event)
- `proofs.yml` → **default** (Lean runs are multi-hour on cold
  cache; cancelling superseded PR commits is the highest-leverage
  saving; main runs still protected)
- `bench-nightly.yml` → **scheduled** (per-run group via
  `github.run_id`; never cancel — each scheduled run is independent
  baseline data)
- `fuzz-nightly.yml` → **scheduled** (same — corpus + crash data
  must accumulate)
- `release.yml` → **release** (group: release-${ref}; never cancel
  — cancelling mid-publish leaves SLSA attestations + registry
  pushes inconsistent)

Verification per the brief:
- yaml.safe_load passes on all 5 files
- Diff stays strictly inside `.github/workflows/` (no job restructure,
  no runner changes, no cache changes — all out of scope per brief)

After merge, push a no-op follow-up to any open PR; the earlier run
must show as Cancelled within ~30s. Post-merge main run must NOT
be cancelled.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

.github/workflows/bench-nightly.yml

@@ -8,6 +8,13 @@ name: Bench Nightly
 # Scheduled at 03:30 UTC, offset from other nightly jobs (e.g. fuzzing)
 # so bench machines aren't contending for runner minutes.
 
+# Each scheduled run is independent baseline data — must complete and
+# never cancel its predecessor. Use a per-run group so two scheduled
+# runs never queue or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
 on:
   schedule:
     - cron: "30 3 * * *"

.github/workflows/ci.yml

@@ -1,5 +1,12 @@
 name: CI
 
+# Cancel superseded PR runs; never cancel runs on main / tags / scheduled
+# events. See docs/ci-concurrency.md (or the org-wide CI concurrency brief)
+# for rationale.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 on:
   push:
     branches: [main]

.github/workflows/fuzz-nightly.yml

@@ -1,5 +1,12 @@
 name: Fuzz (nightly)
 
+# Each scheduled fuzz run is independent corpus + crash data — must
+# complete and never cancel its predecessor. Per-run group so two
+# scheduled runs never queue or cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
 on:
   schedule:
     # Daily 03:00 UTC

.github/workflows/proofs.yml

@@ -16,6 +16,12 @@ name: Lean Proofs
 # (`proofs/.lake`) keyed on `lake-manifest.json`, so warm runs only
 # rebuild the in-tree proof modules.
 
+# Lean proof runs are multi-hour on cold cache. Cancel superseded PR
+# runs aggressively; never cancel main / scheduled / tag runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 on:
   push:
     branches: [main]

.github/workflows/release.yml

@@ -1,5 +1,12 @@
 name: Release
 
+# Releases publish to registries + write SLSA attestations. Cancelling
+# mid-publish leaves external state inconsistent. Group for
+# serialization (one release per tag), never cancel.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 on:
   push:
     tags: