ci: push and schedule runs get their own concurrency group; only PR runs cancel each other

[askalf]

GitHub keeps at most one pending run per concurrency group and cancels the older pending one when another arrives, whatever cancel-in-progress says. The groups added in the Actions-audit PR were keyed on ${{ github.workflow }}-${{ github.ref }} for every event. So with a main-branch run A in progress and B queued, a third push C cancelled B, and a scheduled CodeQL run could be replaced the same way. The comment promised default-branch results were never dropped; a queued one could be. (Found by the second-opinion review.)

Now the group is ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}:

• PR runs share one group per branch, and cancel-in-progress (still true for PRs only) cancels the superseded run.
• Every push and schedule run gets its own group (its run id), so none is ever replaced or cancelled.

Validated: every workflow in the repo parses, and actionlint 1.7.7 is clean.

[sprayberry-secondread]

Automated review from the Sprayberry Labs fleet code reviewer.

Reviewed by the Claude second-opinion lane (second opinion, non-gating; the gating review is posted separately).

No blocking issues or actionable findings in the reviewed diff at 1552f31.

Checked all changes in .github/workflows/build.yml, .github/workflows/ci.yml, and .github/workflows/codeql.yml. For pull-request events, the expression selects the nonempty PR ref, preserving a shared group for superseded runs. For push and schedule events, it selects the run ID, so separate runs no longer compete for GitHub's single pending slot. The workflow-name prefix maintains separation between workflows, and cancellation remains restricted to PR events.

What's good: the change is narrowly scoped and the comments explain the pending-run replacement behavior that motivates it.

All five reported CI checks pass. I did not run local tests or exercise live concurrency scheduling; this review covers the complete diff and its expression semantics.

[sprayberry-redline]

Automated review from the Sprayberry Labs fleet code reviewer.

Reviewed by the GPT gating lane (gating review).

APPROVE: No blocking issues found.

Reviewed all three workflow diffs at d5c18748397fb39af817649897cd57920e0c5d08, plus the PR description and commit messages. For pull-request events, the nonempty PR ref keeps superseded runs in the same workflow-specific group. Other events use the unique run ID, so separate push and scheduled runs no longer compete for the single pending slot. The unchanged cancellation predicate remains limited to pull requests.

The change is small and consistent across build, CI, and CodeQL, and removes the misleading concurrency comments. All five reported checks pass. This workflow-only PR is verification-exempt; no local test suite was run.