[aicayzer]

Summary

cancel-in-progress: true also applied to pushes to main, so a later push could cancel the run on the commit before it and lose that commit's verdict. That verdict is what Publish waits for, so a cancelled run also meant no publish for the commit. A push to main or a manual run now gets a concurrency group of its own, and only a pull request's run is cancelled when a newer one starts.

Changes

• ci.yml and openapi-validate.yml: the concurrency group is the pull request's ref for a pull request and the run id for anything else. cancel-in-progress is true only for a pull request.
• codeql.yml: the same rule. Its group also includes whether a pull request is a draft, because it skips a draft and analyzes the pull request on ready_for_review, so a draft's run and the ready run no longer cancel each other.
• .github/scripts/ci-changes.test.sh: pins the per-run group and the cancellation rule for ci.yml.

Testing

• actionlint (1.7.12) on all workflows: clean.
• shellcheck on the changed test script: clean.
• bash .github/scripts/ci-changes.test.sh: all checks pass. With ci.yml put back to its old concurrency block, the two new checks fail, so they detect the change.
• Not tested: a real run on GitHub, which needs the pull request itself.

Notes for reviewers

• The draft-then-ready race does not apply to ci.yml. It has no draft gating: it runs the same jobs for a draft and a ready pull request, and its required check is Build and type-check. Only codeql.yml, which is not required, has it.
• publish.yml is unchanged. It already uses cancel-in-progress: false.
• A manual run of ci.yml or openapi-validate.yml no longer cancels an earlier manual run on the same ref.
• Review depth: low risk, workflow configuration only.

Checklist

• The title is a scoped Conventional Commit.
• New behavior has a test that was seen failing first, or no test was needed and the reason is above.
• Docs, comments and the contract still say what is true after this change.