Cancel superseded pull request validation

Replacement PR checks were queued behind obsolete runs even after the
previous revision failed. Cancel prior validation only for pull_request
events, preserving completed verdicts for branch pushes and manual runs.

Contract-Neutral: Only PR concurrency changes. Semantic YAML comparison confirms all jobs and triggers, including frontend dependency security checks, are unchanged. No security verification change is warranted. The scheduling contract is updated.

.github/workflows/build-and-test.yml

@@ -16,14 +16,12 @@ on:
 permissions:
   contents: read
 
-# Let the in-progress run finish (pushes land here every few minutes on a
-# busy day, and cancelling would mean main never completes a verdict — four
-# consecutive runs were cancelled on 2026-07-17 alone); queued runs collapse
-# to the newest pending one, so intermediate pushes skip. Mirrors the Core
-# E2E workflow's concurrency policy.
+# Let branch runs finish so busy main and release branches retain verdicts.
+# A newer PR commit supersedes its previous validation, so do not queue the
+# replacement behind obsolete checks. Keep this aligned with Core E2E.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   secret-scan:

.github/workflows/test-e2e.yml

@@ -26,12 +26,12 @@ on:
       - '.github/workflows/test-e2e.yml'
   workflow_dispatch:
 
-# Let the in-progress run finish (pushes land here every few minutes, and
-# cancelling would mean a busy main never completes a verdict); queued runs
-# collapse to the newest pending one, so intermediate pushes skip.
+# Let branch runs finish so busy main and release branches retain verdicts.
+# A newer PR commit supersedes its previous validation, so do not queue the
+# replacement behind obsolete checks. Keep this aligned with Build and Test.
 concurrency:
   group: e2e-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -15,6 +15,15 @@
 
 ## Purpose
 
+### Superseded pull request validation
+
+Build and Test and Core E2E cancel an older run for the same pull request when
+a newer commit starts validation. Branch pushes and manual dispatches retain
+their in-progress runs, so busy main and release branches still finish verdicts.
+Concurrency groups continue to isolate workflows and refs. Cancellation of an
+obsolete PR run supplies no passing evidence for its replacement, which still
+needs its own checks. Release publication workflows are unaffected.
+
 ### Docker SDK dependency compatibility
 
 The Docker consumers use Moby API v1.56.0 and client v0.6.0 together, without