ci: diet — concurrency cancel + no push/PR double runs

[jkbennitt]

What changed

Workflow-only diet of .github/workflows/ci.yml. Product/Python package code, harnesses, and docs content are untouched. benchmark.yml and release-please.yml are untouched so the weekly scheduled Benchmark cannot share a PR concurrency group.

1. Concurrency + cancel-in-progress on the main CI workflow:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   Obsolete runs on the same PR (or the same push ref) are cancelled. PR and master-push groups stay distinct, so a landing master run is not cancelled by a PR and Benchmark is not in this group.

2. No push+PR double run for the same SHA (common case). push now fires on master only. Contributor and feature/** work is covered by pull_request (same job names, same extras installs). A feature/** tip with an open PR is no longer also tested via push. SHA-keyed concurrency was not used: pull_request runs the merge SHA, so a shared SHA group would race and could cancel the required PR checks.

3. Docs-only paths-ignore is push-only (**/*.md, docs/**). It is not applied to pull_request, so required checks always report for contributors. No invent-green, no draft/lean skip path, no renamed/removed jobs.

Required checks (unchanged for contributors)

Job names and coverage are unchanged: lint, test, test-no-felix, smoke-test, external-plugin-contract. Felix/mcp extras installs are unchanged. Fork PRs still only see pull_request (same as today) and still run the full suite.

Double-run prevention

Event	Before	After
PR from feature/** (and the feature/** push)	Both push and pull_request ran the full suite	pull_request only
Push to master (merge / direct)	Full suite	Full suite (docs-only commits skipped)
Fork / external contributor PR	pull_request full suite	Unchanged: pull_request full suite
New commits on an open PR	Previous PR run kept burning minutes	Previous PR run cancelled

Product code

Untouched. Diff is .github/workflows/ci.yml only.