ci: main runs are cancelled by the next merge, and Typecheck skips some inputs that change its result #1465

What

Two gaps in .github/workflows/ci.yml:

1. concurrency sets cancel-in-progress: true for every event, so on main each merge cancels the run started by the merge before it. On 2026-10-06 several main runs were cancelled this way, and no run completed for those commits, so nobody could tell whether main was healthy.

2. The typescript path filter, which gates both the Typecheck job and the TypeScript test job, misses inputs that change their results:

   • patches/**: bun install applies these, some of them edit typed .d.ts files, and bun.lock records only the patch paths. A PR that only edits a patch changes no filtered file.
   • script/check-tracker-leaks.ts and script/upstream/**: opencode's tests import them, and opencode's typecheck compiles its tests.

   Also, an edit to the Typecheck job in ci.yml does not run Typecheck on its own PR. (Raised in the review of fix(ci): typecheck every workspace on PRs and main #1413.)

The push run on main still catches the filter gaps, but only after merge.

Suggested fix

• cancel-in-progress only for pull_request events.
• Add the three paths to the typescript filter.
• Add a typecheck filter matching ci.yml that runs only the Typecheck job, not the 60-minute test job.