ci: cancel in-progress runs on same-ref pushes

Add a top-level concurrency block to ci.yml keyed on
(workflow, ref) with cancel-in-progress: true. Pushes (including
force-pushes) to the same ref now retire any in-flight run for
that ref rather than letting the superseded and current-tip runs
both burn runner minutes.

Motivated by a 2026-05-14 force-push experience where two CI runs
ran concurrently against a feature branch — the original push at
c76ec99 continued for ~17 minutes alongside the amended push at
927ef47, despite only the latter being the live tip.

Scope deliberately limited to ci.yml. Tag-triggered release-build
workflows (package-*.yml, aur-publish-*.yml) are untouched — they
operate on per-tag refs that already form distinct concurrency
groups and release artifact builds generally should not be
cancellable by unrelated activity.

.github/workflows/ci.yml

@@ -11,6 +11,10 @@ on:
         type: boolean
         default: false
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   checks: write
   contents: read

CHANGELOG.md

@@ -22,6 +22,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   assistant policy, and project communication channels. Added
   `docs/branching.md` as the long-form companion covering the release
   workflow, version conventions, and merge-direction rationale.
+- CI workflow (`.github/workflows/ci.yml`) now declares a top-level
+  `concurrency` block keyed on `(workflow, ref)` with
+  `cancel-in-progress: true`. Force-pushes and rapid successive
+  pushes to the same ref now retire the in-flight run rather than
+  letting superseded and current-tip runs both consume runner minutes.
+  Tag-triggered release-build workflows are deliberately untouched.
 
 ### Fixed