[ExtraToast]

What

Adds the estate concurrency block to the workflows below that had none, or switches one that cancelled unconditionally to the guarded form:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

• .github/workflows/deploy-preview.yml: added
• .github/workflows/repository-hygiene.yml: added

Why

Every push to a pull request started a fresh run while the previous one, whose result nobody reads any more, kept its runner until it finished. Superseded runs now cancel as soon as a newer push lands. Runs on main are never cancelled mid-flight. This is the same block ~40 ci.yml files in the estate already carry.

[github-actions]

Deploy Preview — knowledge

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:95dc39fc695694c8fb4b0c538d7fe13038d407c7302c3725c98f0496c6a83499
Workloads: 2 | Routes: 1 | Gatus endpoints: 1

Image refs

• knowledge-api: ghcr.io/jorisjonkers-dev/knowledge/knowledge-api@sha256:0000000000000000000000000000000000000000000000000000000000000000
• knowledge-ingest-worker: ghcr.io/jorisjonkers-dev/knowledge/knowledge-ingest-worker@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status	Detail
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass	exempt by health.mandatory: false: knowledge-ingest-worker
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
✅	stateful_policy_declared	pass
➖	raw_manifests_guarded	not_applicable	no workload enables rawManifests
➖	npm_signatures_verified	not_applicable	provenance is only evaluated when publishing an artifact

pass = ready · fail = blocks deployment · not_applicable = check does not apply

➖ 2 check(s) not applicable: raw_manifests_guarded, npm_signatures_verified

---

Updated by deploy-check on push to this PR.