fix(ci): move changes job off self-hosted runner + add workflow concurrency

Two changes to relieve macOS arm64 runner contention:

1. `changes` job: runs on `ubuntu-latest` instead of
   `[self-hosted, macos, arm64]`. This job does a plain `git diff`
   — it has zero macOS dependencies. Moving it off the runner frees
   the slot immediately on every workflow trigger.

2. Add workflow-level concurrency to `ci.yml`:
   `concurrency: group: ci-${{ github.ref }}; cancel-in-progress: true`

   Without this, every new push to a PR or main queues a full new
   workflow run, each competing for the same single runner. With
   `cancel-in-progress: true`, stale in-flight CI runs are cancelled
   when a newer commit arrives — the runner always runs the latest
   state, not a backlog of old ones.

Context: the self-hosted macOS arm64 runner is shared by ci.yml,
e2e-api.yml, canary-verify.yml, and publish-*.yml. The combination of
(1) the `changes` job holding the runner during `fetch-depth: 0`
checkout on every trigger, and (2) no workflow-level cancellation
caused 100+ queued runs with 0 in-progress.

Follow-up candidates (need verification before changing):
- platform-build: Go build may work on ubuntu-latest (no macOS deps)
- canvas-build: Next.js build may work on ubuntu-latest
- python-lint: needs `setup-python` instead of Homebrew Python

Co-authored-by: Molecule AI Infra-SRE <infra-sre@agents.moleculesai.app>

.github/workflows/ci.yml

@@ -6,13 +6,21 @@ on:
   pull_request:
     branches: [main, staging]
 
+# Cancel in-progress CI runs when a new commit arrives on the same ref.
+# This prevents multiple stale runs from queuing behind each other and
+# monopolising the self-hosted macOS arm64 runner.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # Detect which paths changed so downstream jobs can skip when only
-  # docs/markdown files were modified. Uses git diff (no Docker — works
-  # on macOS self-hosted runners unlike dorny/paths-filter).
+  # docs/markdown files were modified. Uses plain `git diff` — no macOS
+  # dependency, so this runs on ubuntu-latest to free the self-hosted
+  # macOS arm64 runner for jobs that genuinely need it.
   changes:
     name: Detect changes
-    runs-on: [self-hosted, macos, arm64]
+    runs-on: ubuntu-latest
     outputs:
       platform: ${{ steps.check.outputs.platform }}
       canvas: ${{ steps.check.outputs.canvas }}