fix(ci): keep per-commit range gates uncancellable

[localai-org-maint-bot]

Outcome

Fixes a fail-open gap in ROAD-V1-A6: the documentation-checkpoint and commit-protocol-tag jobs each validate a unique push before..sha range, but job-level cancel-in-progress: true allowed a later main push to cancel the only run covering the earlier range.

The fix removes cancellation only from those two range-scoped jobs. Workflow-level pull-request deduplication and every tree-scoped job remain unchanged.

Design selected

I evaluated three approaches:

1. remove cancellation from every CI job, which wastes capacity and changes unrelated tree-scoped behavior;
2. make later runs recheck prior push history, which duplicates work and complicates new-branch handling;
3. keep the existing range semantics and make only the two unique-range jobs uncancellable.

This PR chooses option 3. The accepted spike and implementation plan are in .agents/specs/ci-per-commit-gates.md and docs/superpowers/plans/2026-08-01-ci-per-commit-gates.md.

TDD evidence

RED first: the new static invariant reported four violations, concurrency and cancel-in-progress on each protected job.

GREEN: removing only the two job-level blocks makes the invariant pass. Mutation cases independently inject both forbidden keys into both jobs and prove the test rejects them.

Verification

CPU-only gates, all green:

• python3 tests/scripts/test_ci_per_commit_gates.py (3 tests)
• python3 -m unittest discover -s tests/scripts -p 'test_*.py' (98 tests)
• python3 scripts/check-agent-record.py plus 13 mutation tests
• python3 scripts/check-doc-checkpoint.py --staged plus 5 mutation tests
• README structure plus 18 mutation tests
• model checklist plus 10 mutation tests
• fusion consistency plus 18 mutation tests
• device leakage plus 24 mutation tests
• environment documentation plus 7 mutation tests
• git diff --cached --check

No C/C++, build, runtime, model, kernel, fixture, README, lifecycle, support, GPU, download, or benchmark behavior changes. Benchmark disposition is NOT APPLICABLE (benchmark_binding=false).

Slack

The required selection notification was attempted through the bundled secret-safe sender. No channel is configured; #general returned channel_not_found. No credential was read or exposed.

FOLLOWING_AGENTS_PROTOCOL