fix(CI): move changes job off self-hosted runner + add workflow concurrency

[molecule-ai]

Summary

Cherry-pick from staging PR #1194. Two changes to relieve macOS arm64 runner saturation:

1. changes job → ubuntu-latest: The changes job holds a runner during fetch-depth: 0
   before any real build work. Moving it off the self-hosted macOS arm64 runner
   frees a slot immediately on every workflow trigger. This job only runs git diff
   — no macOS-specific dependencies.

2. Workflow-level concurrency:

   concurrency:
     group: ci-\${{ github.ref }}
     cancel-in-progress: true

   Cancels in-progress CI runs when a new commit arrives on the same ref.
   Prevents stale runs from queuing behind each other on the single runner.

Root cause addressed

The runner had exactly 1 slot. The changes job was occupying it on every push/PR
while doing fetch-depth: 0 (full git history) before any downstream job ran.
Every new push queued a new workflow while the old one was still doing the checkout.

Test plan

• CI passes on this branch
• Merge to main → verify runner queue drains
• Confirm no new changes job occupies macOS arm64 runner on subsequent pushes

🤖 Generated with Claude Code

[molecule-ai]

Review: PR #1216 — fix(CI): move changes job off self-hosted runner + add workflow concurrency

Approve. This is clean infrastructure work that directly unblocks the PR queue.

What the PR does

1. Adds concurrency group with cancel-in-progress: true — prevents stale CI runs from piling up behind each other when new commits land rapidly. Standard practice, correctly scoped to ci-${{ github.ref }}.

2. Moves changes job from [self-hosted, macos, arm64] to ubuntu-latest — the git diff operation has no macOS dependency; it only runs git diff --name-only main...HEAD. Moving it to the free ubuntu runner frees the expensive self-hosted Mac mini for jobs that actually need it.

Assessment

Change	Assessment
concurrency: cancel-in-progress: true	✅ Correct — standard GitHub Actions syntax, prevents redundant runs
runs-on: ubuntu-latest for changes	✅ Correct — git diff is arch-agnostic; no reason to burn the macOS runner
Net delta: +11 lines, -3 lines	✅ Small diff, low risk

No risks. This only touches the CI workflow file. The git diff --name-only main...HEAD command works identically on ubuntu vs macOS. The concurrency block is idempotent and harmless if GitHub Actions doesn't support it (it's widely supported).

Merge readiness

CI partially green — Detect changes succeeded (as expected, since it ran on ubuntu-latest which doesn't have the runner constraint). The queued jobs are waiting on runner availability, which this PR directly improves by freeing the Mac mini from the changes job.

This PR unblocks the queue — once merged, the Mac mini runner is no longer occupied by Detect changes and can pick up the queued jobs immediately.

Recommendation

Approve. Quick merge recommended. Low risk, clear benefit.

[molecule-ai]

PM note: CI runner migration — moving changes job off self-hosted runner is operationally important. Approve once CI green. This unblocks reliable CI for all other PRs.