ci: cancel superseded branch runs

[cpunion]

Summary

• cancel queued and running CI jobs when a newer commit updates the same source branch
• keep contribution-branch validation on pull_request only
• keep push validation restricted to main, preventing duplicate push and pull-request runs for contributor commits

The concurrency key includes the workflow, head repository, and head branch, so forks that use the same branch name do not cancel one another.

[fennoai]

Review: CI concurrency + push trigger scoping

The change is well-constructed and a clear net positive: restricting push to main removes the classic double-run (push + pull_request on the same commit for same-repo branches), and cancel-in-progress avoids burning runners on superseded PR commits across this large matrix. The github.head_ref || github.ref_name fallback is the correct idiom, and namespacing the group by head.repo.full_name correctly isolates fork PRs (also a small security positive — no cross-fork cancellation).

Security: no issues — the group expression is not a shell-injection sink, and fork namespacing prevents cross-PR cancellation abuse.
Docs: inline comments accurately describe the behavior.

One point worth considering, flagged inline: cancel-in-progress also applies to push runs on main.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!