ci: cancel superseded actionlint and skill-docs runs

[jbetala7]

Problem

actionlint.yml (Workflow Lint) and skill-docs.yml (Skill Docs Freshness) both trigger on push and pull_request but declare no concurrency. On a same-repo PR branch, every new push leaves the previous (now-obsolete) runs queued/running for superseded commits, and the PR also double-runs them (once for the push, once for the PR). The heavier workflows already cancel superseded runs:

• evals.yml → concurrency: group: evals-${{ github.head_ref }} + cancel-in-progress: true
• windows-free-tests.yml, make-pdf-gate.yml, version-gate.yml, pr-title-sync.yml — same pattern

These two always-on lightweight workflows were the only push + pull_request ones missing it.

Fix

Add a concurrency block to both workflows, keyed on github.head_ref || github.ref_name — head_ref for pull_request, with ref_name as the fallback for push (where head_ref is empty), so a rapid push series collapses to the newest run instead of piling up stale ones.

Regression test

test/workflow-concurrency.test.ts (gate-tier, free) statically scans .github/workflows/*.yml, parses each on: block (handles both the inline-array and mapping forms; treats pull_request_target as distinct from pull_request), and fails CI if any workflow triggered by both push and pull_request lacks cancel-in-progress: true. It also pins actionlint.yml and skill-docs.yml explicitly so a future trigger rename can't silently drop them from the checked set.

Testing

• bun test test/workflow-concurrency.test.ts → 5 pass. Proven fail-on-base: reverting the two workflow edits fails 4 of the 5 assertions.
• actionlint v1.7.11 on both edited workflows → clean.
• Workflow-only + test change: version-gate is not triggered (only fires on VERSION/CHANGELOG.md/package.json).

Fixes #2046

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[time-attack]

Thanks for this. Concurrency groups based only on branch names can collide across forks and cancel unrelated runs. Please include repository identity while retaining same-repository push/PR deduplication, and test both intended deduplication and cross-fork isolation.

[capy-ai]

Thanks for this, @jbetala7. The fix is now on main: actionlint.yml and skill-docs.yml both have concurrency groups keyed on the PR number, so superseded runs are cancelled without cross-fork collisions (fixed in v1.74.0.0, #2721). Closing as superseded; if you still see the problem on the latest gstack, please open an issue with ./setup --status output.