ci: cancel superseded PR runs

[2000game]

Changes

• CI and Docs: add concurrency so a newer push to a PR cancels that PR's run still in progress. Pushes to main are never cancelled. Release is untouched (it publishes, so it must not be cancelled).

Considered and left alone

• macOS jobs (smoke-darwin-*) already run only in Release on push to main, never on PRs. They are the only native check on the compiled binaries before semantic-release publishes, so running them less often would ship unverified binaries.
• paths-ignore on CI: not safe. format:check runs prettier --check ., which covers Markdown, so a docs-only change can still fail CI.
• Docs build on src-only changes: the workflow is already path-filtered, and staleness has to run on src/**. Splitting build off would save about 1 free minute per run and add another workflow.
• Merging jobs: nothing to merge. build and staleness use different toolchains, and minute rounding costs nothing here.

Required checks

main has no branch protection and no rulesets, so no check names change or matter.

Billing context: these minutes don't count against the org quota

This repo is public, and GitHub-hosted standard runners are free for public repos. The September usage report does list them (every line shows grossAmount == discountAmount, netAmount: 0), but that is a 100% public-repo discount. It is not drawn from the Team plan's 3,000 included minutes. The org totals show this:

• Org-wide September gross: 2,916 Linux min ($17.50) + 12 macOS min ($0.74) = $18.24. That's more than the $18.00 the 3,000 included Linux minutes are worth, yet netAmount is still 0. Something other than the included quota absorbed the difference, and that is the public-repo discount.
• Public-repo share: ct-cli 128 min (116 Linux + 12 macOS) and terraform-provider-churchtools 175 Linux min. Without them, the private repos used about 2,625 Linux-equivalent minutes (~87% of 3,000).
• Both repos were public for all of September: ct-cli since 2026-08-27 (PublicEvent), and terraform-provider-churchtools was created public on 2026-09-16.

So the quota pressure comes from the private repos (eqrm-infra 906, ct-structure 727, church-network-management 715, …). This PR is hygiene only and saves no billed minutes. It still helps a little: hosted jobs from public repos take up the org's concurrent-job slots alongside private CI, and superseded PR runs just waste them.