ci(concurrency): stop cancelling the run a merge is read against, and give the release a bracket

[yeapea]

Two files, two different defects, both about which run survives.

ci.yml — cancels the run a merge is read against

It fires on a push to main and develop and cancelled unconditionally. A second push on the same ref throws that run away, and what survives is a check that reported nothing — a cancelled check reads as noise rather than as a failure, so the merge is measured by an absence.

- cancel-in-progress: true
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Outside a pull request the group then only serialises: two runs stay off one ref, for free. The cancel stays where it pays — a pull request whose later push overtook the run in flight, which is where GitHub's per-job minute rounding actually bills for an answer about a tree that no longer exists.

release.yml — no bracket at all, and it must never cancel

It had none. It gets one that serialises and never cancels:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

The run is started by a v*.*.* tag push or by hand. Both are deliberate acts somebody is waiting on the result of, and a cancelled release run is the worst case of the paragraph above.

⚠️ The fleet's usual expression is deliberately not used here. cancel-in-progress: ${{ github.event_name == 'pull_request' }} is right wherever a pull request can start the workflow — it cannot here, since on: carries a tag push and workflow_dispatch only. The expression would evaluate to false on every run this file can have: a line that reads as a live decision and is a constant.

This fleet has paid for that shape before — a sibling repository carried the same expression over a workflow_dispatch-only trigger, and the note there records it as "a condition that could not come true". So it lands as the constant, and the comment names the restoration: bring the expression back in the same change that adds a pull_request trigger.

The group still earns its place either way — two releases must not run against one ref at once.

Found by tools/workflow-concurrency-sweep.sh in claude-baseline.