perf(ci): ran CI once per commit and cancelled superseded pull request runs

[FlareCoding]

Summary

• Every push to a pull request branch started two runs of the same commit, one for push and one for pull_request. That doubled the jobs competing for the account's concurrent job limit, and one run could fail while the other passed.
• Pushes run CI only for master, since every other branch under review already runs through its pull request.
• A newer commit on a pull request cancels the run still testing the older one. Each push keeps its own run, so every master commit is still tested.

---

Note

Low Risk
CI trigger and concurrency-only changes; no application or test logic is modified.

Overview
Kernel CI no longer runs twice for the same commit on feature branches: push triggers are limited to master, while pull requests still run the full pipeline for branches under review.

A concurrency group keyed by workflow plus PR number (or commit SHA on push) with cancel-in-progress: true drops in-flight runs when a pull request gets a newer commit; each push to master keeps its own run via SHA grouping.

^{Reviewed by Cursor Bugbot for commit 8fff214. Bugbot is set up for automated code reviews on this repo. Configure here.}