Phase 1 quick wins: bounded SHA fetches, concurrency-group fallback, paths-ignore in templates/ci.yml

The "one small actions-repo PR" bundle from #92 Phase 1 — three independent quick wins, all in this repo:

• --depth=1 on the two still-unbounded SHA fetches in scripts/detect-changed-lectures.sh:26-27. Shippable today; lecture-python.myst has no copy of the script (it calls preview-netlify@v0, which invokes ours), so only the checkout side is consumer work — tracked with the consumer items.
• Concurrency cancellation fallback in templates/ci.yml:24-26: group: ci-${{ github.event.pull_request.number || github.run_id }}. The template has the group and cancel-in-progress: true but not the fallback, and the fallback is load-bearing: both consumers also trigger on workflow_dispatch, so a verbatim copy puts every manual run in the empty group ci-, cancelling each other. Also closes a stale-overwrite hazard.
• Paths filters (paths-ignore fail-open variant) in templates/ci.yml so docs-only PRs skip the preview — the template has no paths key at all.

Related, deliberately not here: the CLI-install gate on pull_request for both preview actions folds into #105 (same two steps it wants pinned — one PR, not two); the zstd/tag-input item stays separate because :zstd must be validated before :latest moves.

Start with scripts/detect-changed-lectures.sh:26-27 and templates/ci.yml:24-26, then inspect the template's workflow triggers and its two consumers. Add bounded SHA fetches, the pull-request-number/run-id concurrency fallback, and a fail-open paths-ignore filter so docs-only pull requests skip previews without collapsing manual runs. Done means all three checklist items are reflected in the reusable template and script.