ci(root): stop a main run from cancelling the commit before it

.github/workflows/ci.yml

@@ -12,8 +12,24 @@ on:
 permissions:
   contents: read
 
+# Superseding is right for a branch under review and wrong for `main`.
+#
+# On a pull request a new push makes the previous run's verdict irrelevant, so
+# every push shares one group and cancels the last: minutes saved, nothing lost.
+#
+# On `main` every commit is a distinct artifact somebody will later ask "was that
+# green?" about, so each push gets a group of its OWN. Sharing a `github.ref`
+# group there cancelled the previous commit's run on every merge, and a REQUIRED
+# check reporting `cancelled` is indistinguishable from one that failed — which
+# trains people to merge past red.
+#
+# The group has to differ per commit rather than the cancellation merely being
+# switched off. A group holds at most one running AND one pending run, so with
+# three merges in quick succession the third displaces the second while it is
+# still queued: the middle commit ends up cancelled regardless of
+# `cancel-in-progress`. Keyed by `github.sha`, there is nothing to displace.
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/integration.yml

@@ -22,8 +22,12 @@ on:
 permissions:
   contents: read
 
+# Keyed per commit on `main` for the same reason as the CI workflow: a shared
+# `github.ref` group cancelled the previous commit's run on every merge, and
+# switching cancellation off is not enough — a group holds one running and one
+# pending run, so a third merge displaces the second while it is still queued.
 concurrency:
-  group: integration-${{ github.ref }}
+  group: integration-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
   cancel-in-progress: true
 
 jobs: