ci: cancel superseded workflow runs on PR pushes

[claude-dataviking]

From the org CI-cost audit: cut wasted GitHub Actions runner minutes.

Every push/pull_request workflow that lacked a top-level concurrency: key now gets one:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

cancel-in-progress is scoped to pull_request events only, so a superseded PR push cancels its in-flight run, while pushes to main and the tag/main release path in publish.yml are never cancelled (they serialize instead of aborting).

Workflows changed: ci.yml, publish.yml.
Left untouched: interop-drift.yml (schedule/workflow_dispatch only — no push/pull_request trigger).

🤖 Generated with Claude Code