ci: concurrency groups for ten gates that queued a run per merge

.github/workflows/fpga-build.yml

@@ -53,6 +53,14 @@ on:
       - '.github/workflows/fpga-build.yml'
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: fpga-build-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   fpga-smoke:
     # A hung apt step ran 6h0m16s to the GitHub ceiling on 2026-08-18 and

.github/workflows/gate-topology.yml

@@ -20,6 +20,14 @@ on:
   # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: gate-topology-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   gate-topology:
     runs-on: ubuntu-latest

.github/workflows/notebook-gate.yml

@@ -24,6 +24,14 @@ on:
 permissions:
   pull-requests: write
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: notebook-gate-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check-notebook-id:
     runs-on: ubuntu-latest

.github/workflows/now-sync-gate.yml

@@ -39,6 +39,14 @@ on:
   # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: now-sync-gate-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check-now-freshness:
     runs-on: ubuntu-latest

.github/workflows/schema-validation.yml

@@ -29,6 +29,14 @@ on:
     branches: [master]
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: schema-validation-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # The job id is the status-check CONTEXT that branch protection matches on.
   # It was `validate` and must stay `validate`: renaming it makes the required

.github/workflows/scorecard.yml

@@ -31,6 +31,14 @@ on:
 # Top-level token is read-only; jobs elevate only what they need.
 permissions: read-all
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: scorecard-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analysis:
     name: Scorecard analysis

.github/workflows/seal-coverage.yml

@@ -36,6 +36,14 @@ on:
     branches: [master]
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: seal-coverage-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   coverage:
     runs-on: ubuntu-latest

.github/workflows/secret-scan.yml

@@ -21,6 +21,14 @@ on:
   # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   scan:
     runs-on: ubuntu-latest

.github/workflows/untrusted-input-gate.yml

@@ -31,6 +31,14 @@ on:
 permissions:
   contents: read
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: untrusted-input-gate-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   untrusted-input:
     runs-on: ubuntu-latest

.github/workflows/withdrawn-live-gate.yml

@@ -27,6 +27,14 @@ on:
     branches: [master]
   workflow_dispatch:
 
+# A run for a commit that has since been superseded measures nothing anyone
+# will read. Without a group, every merge to master queued one more run of
+# this gate behind the last: 62 were waiting on 2026-09-17 while the 15
+# workflows that do carry a group had exactly one each.
+concurrency:
+  group: withdrawn-live-gate-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   withdrawn-live:
     runs-on: ubuntu-latest