Concurrency groups to cancel stale PR runs

Every push to a PR branch triggers a new CI run. Old runs keep executing even after new commits invalidate them, wasting runner minutes and cluttering the PR status checks UI.

Use concurrency groups with cancel-in-progress:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

For deployment workflows, never cancel in-progress production deploys—use a different group strategy:

concurrency:
  group: deploy-production
  cancel-in-progress: false  # queue instead of cancel

For PR comment-triggered workflows, use the PR number:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

cancel-in-progress: true immediately kills the old run when a new one starts for the same group. For production, false means the new run waits, preventing race conditions between two deployments.