chore(ci): drop redundant push trigger; add concurrency group

The `push` + `pull_request` combo doubled CI runs on every PR (visible
on #170 with 4 pending checks instead of 2). Drop `push`, keep
`pull_request: branches: [main]`.

Trade-off: branches pushed without an open PR no longer get CI
feedback. Open a draft PR if you want CI to run before requesting
review — `/fix-issue` always opens a PR right after pushing, so the
gap is essentially zero in practice.

Also adds a concurrency group `ci-${{ github.ref }}` with
cancel-in-progress so force-pushes cancel the previous run instead
of stacking.

Same change applied to .github/workflows/check.yml (GitHub mirror)
to keep the two configs in sync.

Fixes #171

.forgejo/workflows/check.yml

@@ -1,17 +1,24 @@
 name: PR Check
 
-# Validates Rust + frontend on every branch push and PR.
+# Validates Rust + frontend on every PR opened against main.
 # Goal: catch compile errors, type errors, and failing tests BEFORE merge,
 # instead of waiting for the release tag (which is when release.yml runs).
+#
+# Trigger is `pull_request` only — the previous `push` trigger duplicated
+# every run when a branch was pushed and immediately opened as a PR (#171).
+# Trade-off: branches pushed without an open PR don't get CI feedback. Open
+# a draft PR if you want feedback before requesting review.
 
 on:
-  push:
-    branches-ignore:
-      - main
   pull_request:
     branches:
       - main
 
+# Cancel obsolete runs (e.g. on force-push) so only the latest commit runs.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   rust:
     runs-on: ubuntu

.github/workflows/check.yml

@@ -2,15 +2,20 @@ name: PR Check
 
 # Mirror of .forgejo/workflows/check.yml using GitHub-native runners.
 # Forgejo is the primary host; this file keeps the GitHub mirror functional.
+#
+# Trigger is `pull_request` only — kept in sync with the Forgejo workflow
+# after #171 dropped the redundant `push` trigger that duplicated every run.
 
 on:
-  push:
-    branches-ignore:
-      - main
   pull_request:
     branches:
       - main
 
+# Cancel obsolete runs (e.g. on force-push) so only the latest commit runs.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   rust:
     runs-on: ubuntu-latest