#261 already added a concurrency block to release-npm.yml when switching
the trigger to workflow_run. Rebasing this branch on top stacked the
original release: published variant on top, producing duplicate
top-level concurrency keys (invalid YAML).

Drop the now-redundant block; #261's block (keyed on
github.event.workflow_run.head_branch) is the correct one for the
current trigger.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): add concurrency control to all workflows

Add top-level `concurrency:` blocks to every workflow so superseded PR
runs are cancelled while runs on `main`, tags, releases, and scheduled
events complete normally. Org-wide context: 93 workflows queued across
the org as of 2026-05-02 with the oldest job 23h old; rivet has been
intermittently sitting at 5h+ runner-queue stalls on chore PRs.

Without this, every PR push starts a fresh run while previous runs on
superseded commits keep executing — agents pushing 2-5 commits per
minute multiply queue pressure for zero useful signal. The conditional
`cancel-in-progress: ${{ github.event_name == 'pull_request' }}`
preserves all main-branch and scheduled work.

Variants applied per the brief:

- **default** (cancel only on PR): `benchmarks.yml`, `ci.yml`
- **compliance** (serialize, never cancel — partial reports leave
  registries / attestations inconsistent): `compliance.yml`
- **release** (serialize per-tag, never cancel — partial publish
  leaves npm / GitHub Release inconsistent): `release.yml`,
  `release-npm.yml`. `release-npm.yml` keys on tag-name with
  fallback through `inputs.version` and `github.ref` for
  workflow_dispatch.

Already had correct concurrency, left alone:

- `rivet-delta.yml`: groups by `pull_request.number`, always cancels
  (correct: PR-only workflow, no main runs to protect).
- `fuzz.yml`: groups by ref with `cancel-in-progress: false` (correct
  for hybrid push+schedule workflow; one fuzz run per ref serializes
  cleanly without losing scheduled corpus growth).

Verification before merge:
- All YAMLs parse cleanly via Python yaml.safe_load.
- Diff is workflow-files-only — no job restructure, no runs-on
  change, no caching change.

Trace: skip

* ci(release-npm): drop release-npm concurrency block superseded by #261

#261 already added a concurrency block to release-npm.yml when switching
the trigger to workflow_run. Rebasing this branch on top stacked the
original release: published variant on top, producing duplicate
top-level concurrency keys (invalid YAML).

Drop the now-redundant block; #261's block (keyed on
github.event.workflow_run.head_branch) is the correct one for the
current trigger.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Three queued feature requests now land: rivet bundle (#266), rivet
coverage --matrix (#243), s-expr linked-via operator (#265). Plus
externals load their own schemas (#267) and STPA TCL numbering is
corrected to ISO 26262-8 (#257).

Infrastructure: CI concurrency control across all workflows (#258),
migration to self-hosted smithy runners (#262), release-npm trigger
fix that retroactively unblocked v0.7.0/v0.8.0 npm publication (#261),
weekly dependabot (#216), and the wasmtime 42→43 upgrade that retires
the RUSTSEC-2026-0114 suppression introduced in v0.8.0 (#260).

#125 (provenance-lifecycle) intentionally deferred — 5-week-old branch
with conflicts in heavily-churned files (CLAUDE.md, ci.yml, settings).
Needs its own attention session, not safe to autonomously rebase.

Refs: FEAT-001

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>