ci(OMN-19645): cancel superseded pull request runs in 19 workflows

.github/workflows/auto-merge.yml

@@ -35,6 +35,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: write
   pull-requests: write

.github/workflows/ban-hardcoded-runner-ip.yml

@@ -14,6 +14,10 @@ on:
       - .github/workflows/**
       - tests/**
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ban-hardcoded-runner-ip:
     # OMN-17993: pinned to an exact SHA, not @main. omniclaude main lags dev by

.github/workflows/call-occ-preflight.yml

@@ -24,6 +24,10 @@ on:
   merge_group:
     types: [checks_requested]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   pull-requests: read

.github/workflows/call-receipt-gate.yml

@@ -21,6 +21,10 @@ on:
     branches: [main, dev]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   pull-requests: read

.github/workflows/call-reject-skip.yml

@@ -18,6 +18,10 @@ on:
     branches: [main, dev, "hotfix/**"]
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   pull-requests: read

.github/workflows/check-handshake.yml

@@ -21,6 +21,10 @@ on:
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check-handshake:
     name: Check architecture handshake

.github/workflows/docs-validate.yml

@@ -8,6 +8,10 @@ on:
   push:
     branches: [main, "hotfix/**"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   call:
     uses: OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml@main

.github/workflows/golden-chain-coverage.yml

@@ -16,6 +16,10 @@ on:
   push:
     branches: [main, "hotfix/**"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   golden-chain:
     runs-on: ubuntu-latest

.github/workflows/hardcoded-delegation-refs.yml

@@ -3,6 +3,10 @@ on:
   pull_request:
     paths: ['src/**', 'shared/**', 'server/**']
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/kb-doc-gate.yml

@@ -34,6 +34,10 @@ on:
   pull_request:
     branches: [dev]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   kb-doc-gate:
     uses: OmniNode-ai/omniclaude/.github/workflows/kb-doc-gate-reusable.yml@a78b103e55f1ad595572ecde6ea818c2c585f025

.github/workflows/main-target-guard.yml

@@ -11,6 +11,10 @@ on:
   pull_request:
     types: [opened, edited, synchronize]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   main-target-guard:
     name: main-target-guard

.github/workflows/no-hardcoded-fallbacks.yml

@@ -16,6 +16,10 @@ on:
   pull_request:
     branches: [main, dev, "hotfix/**"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check-fallbacks:
     name: Scan for hardcoded numeric fallbacks

.github/workflows/pr-title-check.yml

@@ -8,6 +8,10 @@ on:
   pull_request:
     types: [opened, edited]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pr-title:
     uses: OmniNode-ai/onex_change_control/.github/workflows/pr-title-check-reusable.yml@main

.github/workflows/public-repo-hygiene.yml

@@ -34,6 +34,10 @@ on:
   pull_request:
     branches: [dev]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   public-repo-hygiene:
     uses: OmniNode-ai/omniclaude/.github/workflows/public-repo-hygiene-reusable.yml@0e19ed86012eb051fefe5ff0d84968b01f749474

.github/workflows/required-check-skip-guard-caller.yml

@@ -42,6 +42,10 @@ on:
   merge_group:
     types: [checks_requested]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.github/workflows/security-scan.yml

@@ -24,6 +24,10 @@ on:
     # Run weekly on Monday at 06:00 UTC
     - cron: "0 6 * * 1"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   codeql:
     name: CodeQL

.github/workflows/stale-todo-gate.yml

@@ -21,6 +21,10 @@ on:
   pull_request:
     branches: [main, dev, "hotfix/**"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   stale-todo-gate:
     name: Stale TODO Gate

.github/workflows/todo-audit-on-merge.yml

@@ -31,6 +31,10 @@ on:
       - dev
       - "hotfix/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   todo-audit:
     name: TODO Audit

.github/workflows/workflow-script-refs.yml

@@ -27,6 +27,10 @@ on:
   pull_request:
   merge_group:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read