Cancels superseded PR CI runs on a new push, never during a live deploy

A new push to a PR previously left the prior CI attempt running
independently instead of superseding it. Scoped strictly to
pull_request events, since deploy-test/deploy-production only ever
run on a push to master or a manual workflow_dispatch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN

.gitea/workflows/continuous_integration.yaml

@@ -16,6 +16,15 @@ on:
   push:
     branches: [master]
 
+# A new push to the same PR does not cancel an already-running CI attempt by default (each
+# `synchronize` event starts an independent run) — this opts in to cancelling the superseded one,
+# but ONLY for pull_request events. `deploy-test`/`deploy-production` never run on a pull_request
+# (they require a push to master or a workflow_dispatch, see those jobs' `if:` conditions), so
+# scoping cancel-in-progress to pull_request here can never abort a live deploy mid-flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 # Reusable settings for this workflow. Change these in one place if the .NET/Node/pnpm version,
 # artifact names, or deploy destinations change. The env context is NOT available inside a called
 # reusable workflow's `with:` inputs (see the `config` job below, which works around this by passing