fix(ci): serialize queued Internal Mail Smoke dispatches

.github/workflows/mail-smoke.yml

@@ -6,6 +6,15 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # One live mailbox/DAV smoke at a time. Keep pending requests up to GitHub's
+  # concurrency-group limit (currently 100); requests beyond that bound may be
+  # canceled. This workflow holds seeded credentials and talks to
+  # customer-adjacent servers, and it is not a merge/release/deploy path.
+  group: mail-smoke-${{ github.repository }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   smoke:
     runs-on: [self-hosted, mail-egress]

backend/tests/test_mail_smoke_concurrency.py

@@ -0,0 +1,20 @@
+"""Regression tests for Internal Mail Smoke concurrency semantics."""
+
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_mail_smoke_concurrency_uses_bounded_pending_queue() -> None:
+    """Require bounded queuing instead of single-pending replacement."""
+    workflow = (REPO_ROOT / ".github/workflows/mail-smoke.yml").read_text(
+        encoding="utf-8"
+    )
+    workflow_header = workflow.split("jobs:", 1)[0]
+
+    assert "concurrency:" in workflow_header
+    assert "group: mail-smoke-${{ github.repository }}" in workflow_header
+    assert "cancel-in-progress: false" in workflow_header
+    assert "queue: max" in workflow_header
+    assert "cancel-in-progress: true" not in workflow_header

backend/tests/test_release_governance.py

@@ -400,6 +400,10 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None:
     assert harden_runner_ref in mail_smoke_workflow
     assert "egress-policy: block" in mail_smoke_workflow
     assert "allowed-endpoints:" in mail_smoke_workflow
+    assert "concurrency:" in mail_smoke_workflow
+    assert "mail-smoke-${{ github.repository }}" in mail_smoke_workflow
+    assert "cancel-in-progress: false" in mail_smoke_workflow
+    assert "cancel-in-progress: true" not in mail_smoke_workflow.split("jobs:", 1)[0]
 
     dependency_review_workflow = read_repo_text(
         ".github/workflows/dependency-review.yml"