chore(ci): cut Actions minutes (concurrency, PR CI/CodeQL)

[jrb00013]

Summary

• Org Actions minute cut for Team-Deepiri: concurrency cancel-in-progress, CI/CodeQL stay on pull_request → main/dev (including subsequent pushes to the PR), drop post-merge push double-fires.
• CD kept (deploy/publish/release triggers untouched aside from safe concurrency where applied).
• CodeQL kept (never removed).
• Docs/markdown paths-ignore + sensible timeout-minutes.

Test plan

• Open a code PR to main/dev → CI + CodeQL run
• Push another commit to the same PR → new run starts, prior cancels
• Merge → no second CI/CodeQL from push on no-CD path
• Confirm CD still triggers on its existing push/tag events (if this repo has CD)

Do not merge without review.

Sent Using Claude

[jrb00013]

@SeanSan06

Hey — this took too long, so I did it myself.

I asked y'all to get Actions minute hygiene done like ~3 weeks ago. Fine, stuff slips. But damn man — you see my velocity?

I have a full-time job, I lead Exovra, and I lead this entire org. In just the last two weeks on Deepiri alone I still shipped, among other things:

• deepiri-juggle-box (Neural Razor): basically the whole V0 control plane — slicer collect/extract ZepGPU jobs, Discord sprint bot, TIES/DARE/linear merge math + tests, 20-rig load proof with streaming artifacts, interference math (APPLIED_MATH.md), fuse/gate entrypoints, CLI, docs, CI. That was a product, not a chore.
• deepiri-platform + diri-cyrex + deepiri-elkedel: Elkedel eyes into Cyrex/platform compose, AGI voice/corpus/reckoning wire, live YOLO/webcam path, training export, submodule pin storms — the actual platform integration work.
• deepiri-polomni: observatory phases D–F (Fisher tomography, SO(2,1) bubble scanner, multi-survey scar consensus, real-sky proof tiers).
• deepiri-crankl: Windows support / v1.0.0, sheaf cohomology perf, Qt6 CI smoke.
• deepiri-tombstone: 2.1.x cache-first early-stop + production speed / SLO gates.
• deepiri-renderflow-studio: RFIR role-residency math so 30GB installs can't be prepaid (#97).
• deepiri-axiom: pure-bash install.sh, sorge/QA skills.
• diva README visual + web-frontend merges.

And I still found time to complete the org-wide Actions optimization your team was supposed to own — concurrency cancel, stop post-merge CI/CodeQL double-fires, keep CD, keep CodeQL, paths-ignore, timeouts, web-frontend job consolidation.

Do not merge until you've actually looked. Review it.

Sent Using Claude

[nhuynh30]

Overall, this looks good. However, I don't think it's ready to merge yet. I found two changes I'd make before merging:

1. Don't use cancel-in-progress: true for releases, because cancelling a release while it's publishing could leave the release or Docker image in an incomplete state.
2. Don't remove push: dev while keeping the dev → main CI skip, because dev will no longer be tested after merges, so the dev → main PR could reach main without CI running.

[nhuynh30]

I don't think we should enable cancel-in-progress for the release workflow. Since this workflow publishes the release, cancelling an in-progress run could leave a release partially published. I'd keep cancel-in-progress: false here.

[nhuynh30]

Removing the push: [dev] trigger makes the dev → main skip incorrect. A merge into dev will no longer run CI, but the later dev → main PR is still skipped. We should either keep the push: [dev] trigger or remove the dev → main skip.