fix(ci): re-sync the five workflows with TheColliery/.github templates/published-code (UMB-123 A)

Source of truth: TheColliery/.github 10f97a7. Per file:
- ci / codeql / markdownlint / scorecard: gain the UMB-053 `concurrency:` groups this
  repo was seeded before (source -> repo). cancel-in-progress true for ci, codeql,
  markdownlint; false for scorecard (it publishes to the OpenSSF API).
- dependabot-auto-merge: gains its per-PR concurrency group with cancel-in-progress
  true (main's r29 ruling; the source was corrected to match in the same unit).
- The codeql-action pins (b96794f, v4.38.0, Dependabot's own PR #1) were already
  here and are unchanged -- the source took them from this repo, not the reverse.

After this, only NOTICE (the source's {{TOKEN}} slots filled) and README.md (the
generated banner) differ from the source, both by design.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: HetCreep

.github/workflows/ci.yml

@@ -25,6 +25,12 @@ on:
 permissions:
   contents: read
 
+# cancel-in-progress: TRUE -- ci.yml only reads, tests and compares; it publishes nothing and
+# touches no external state, so a superseded run has nothing to leave half-done.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   gate:
     name: gate (${{ matrix.os }} · node ${{ matrix.node }})

.github/workflows/codeql.yml

@@ -19,6 +19,13 @@ on:
 permissions:
   contents: read
 
+# cancel-in-progress: TRUE -- a superseded CodeQL run simply never uploads its SARIF, and the
+# previous analysis stands; nothing is left half-written. The newer push analyzes the newer tree,
+# which is the state anyone cares about.
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: analyze (javascript)

.github/workflows/dependabot-auto-merge.yml

@@ -14,6 +14,15 @@ on: pull_request
 permissions:
   contents: read
 
+# cancel-in-progress: TRUE -- the test is ATOMICITY, not read-vs-write. Enabling auto-merge
+# (`gh pr merge --auto`) is IDEMPOTENT within one PR's own group, so a cancelled run corrupts
+# nothing: the next push to that same PR simply re-enables it. Per-PR grouping, never per-ref:
+# two different Dependabot PRs must not serialise behind each other (the ruling lives in
+# TheColliery/.github SKILL-REPO-PATTERN.md's `concurrency:` bullet).
+concurrency:
+  group: dependabot-auto-merge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   auto-merge:
     if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}

.github/workflows/markdownlint.yml

@@ -13,6 +13,12 @@ on:
 permissions:
   contents: read
 
+# cancel-in-progress: TRUE -- a lint run reads files and publishes nothing, so a superseded
+# run has no partial state to leave behind.
+concurrency:
+  group: markdownlint-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/scorecard.yml

@@ -13,6 +13,14 @@ on:
 permissions:
   contents: read
 
+# cancel-in-progress: FALSE, deliberately. Unlike the read-only workflows here, Scorecard
+# UPLOADS a SARIF to code scanning and (with publish_results) posts to the OpenSSF API --
+# outward writes, where a cancellation mid-publish is a partially-applied result rather than a
+# discarded one. It is also schedule-driven, so overlap is rare and queueing costs nothing.
+concurrency:
+  group: scorecard-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   analysis:
     name: Scorecard analysis