Fix workflow concurrency: scope cancellation to individual PRs, never cancel main

[Copilot]

Workflows were cancelling runs across unrelated PRs and cancelling main branch builds. The run.yml concurrency group used github.ref (too broad), and test.yml/build-publish.yml had no concurrency controls.

Changes

All three workflows now use:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Group scoping:

• github.workflow - isolates each workflow's concurrency
• github.head_ref - groups PR runs by branch (only set for PRs)
• github.run_id - fallback for main/release (unique per run)

Cancellation:

• true for PR events → new commit cancels that PR's pending runs
• false for push/release → main builds always complete

Effect

• PR #123 commits cancel only PR #123 workflows
• PR #123 and PR #124 workflows are independent
• Main branch builds never cancel each other

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.