main CI never completes: cancel-in-progress is true for push, so every run is cancelled by the next push (0 successes in 100 runs)

Row: -

main has had no completed CI run in the last 100 runs, spanning 2026-08-31T08:19Z to
2026-09-01T14:22Z. Measured with gh run list --branch main --workflow ci.yml --limit 100:

cancelled  25/30 most recent (83%)
failure     3/30
running     2/30
success     0 of 100 scanned

Cause, at .github/workflows/ci.yml:

concurrency:
  group: ci-${{ github.event_name }}-${{ ... || github.ref }}-${{ github.repository }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

cancel-in-progress is true for push, and every push to main produces the same group
key because github.ref is refs/heads/main every time. Under concurrent operators main
takes a push roughly every 30 minutes while a full CI run takes about 2.5 hours, so each run
is cancelled by the next push before it can finish. The steady state is that main never
gets a verdict.

The file's own comment contradicts the expression. Directly above the block it says
cancel-in-progress "is already false for every non-PR event", and records that #274 added
github.event_name to the key on 2026-08-11 after two consecutive pushes had their
documentation-checkpoint and commit-protocol-tag cancelled, leaving commits cdec2d10
and 0435746d unvalidated. That is the same failure, and it is back - the current
expression names push explicitly.

Why this matters beyond tidiness:

• A cancelled run reads as a failure, not as "not measured", so every PR opened off main
  inherits an unverifiable base.
• Diff-scoped gates that base on "the last green commit" have no green to base on.
• Six merges landed on main today whose only verdicts are local full builds; CI has said
  nothing about any of them, and cannot.

Suggested fix: make cancel-in-progress false for push (keep it true for
pull_request, where superseding a run is correct), so pushes to main queue instead of
cancelling. That trades runner time for actually having a baseline.

Owed: the change, plus a decision on whether to backfill a verdict for the current main
so diff-scoped gates have a base again.

Start with the concurrency block in .github/workflows/ci.yml and confirm the current behavior with gh run list --branch main --workflow ci.yml --limit 100. Update the cancellation policy so pushes to main can complete while pull-request runs remain cancellable. Done means main produces a completed CI verdict; separately, decide whether to backfill the current main baseline.