ci(actions): scoped concurrency + dependabot batching

[kyle-sexton]

What

Applies GitHub Actions volume controls to this repo's own CI entry-point workflows (W4 of the Actions-minutes epic).

• Concurrency keyed on head_ref || run_id in ci, pr-title, selector-conformance, and claude-review-self (the latter previously had no concurrency block). github.head_ref is only set on pull_request, so a new push to a PR cancels the superseded run, while push/workflow_dispatch runs get a unique run_id group and are never cancelled — the previous github.ref-based keys could cancel in-flight default-branch runs.
• Dead merge_group triggers removed from ci and pr-title: merge queue is not available on the org's plan, so these runs can never fire. The root-CI merge_group assertion in select-runner.test.cjs is updated in the same commit; node --test .github/scripts/*.test.cjs passes 180/180. The README's canonical consumer block (documenting merge_group for queue-enabled consumers) is left intact, as are the merge-queue guards inside the semantic-pr reusable workflow — those support external callers and are inert without a queue.
• Dependabot open-pull-requests-limit lowered to 5. Weekly interval, all-actions grouping, and 7-day cooldown were already in place.

Why

Cuts wasted runner minutes from superseded PR runs and never-firing triggers without touching any reusable workflow_call contract — callers own concurrency for reusable workflows, so none of them gain a concurrency block. No select-runner call, selector source, or runs-on expression is modified (avoids overlap with #86).

Part of melodic-software/github-iac#82

🤖 Generated with Claude Code

https://claude.ai/code/session_01EPDbXgonTuFwFwdTtHaCmw

---

Note

Low Risk
Workflow trigger and concurrency tuning only; no reusable workflow_call contracts, runner selection, or application logic changed.

Overview
Tightens GitHub Actions usage on this repo’s entry-point workflows: concurrency now groups on github.event.pull_request.number with github.run_id as the non-PR fallback, so new PR pushes cancel superseded runs while main / workflow_dispatch runs are not lumped together under github.ref. claude-review-self gets the same pattern (it previously had no concurrency block).

merge_group is dropped from ci and pr-title triggers because merge queue isn’t available here; comments point queue-enabled consumers at the README pattern. The root-CI contract test no longer requires merge_group in ci.yml.

Dependabot open-pull-requests-limit goes from 10 to 5 (weekly schedule, grouping, and cooldown unchanged).

^{Reviewed by Cursor Bugbot for commit 0da615b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_cf40269a-a5e1-4a01-9bfe-0d0ebe21b834)

[cursor]

Stale comment

Risk: medium. Not approving: Cursor Bugbot completed as skipped with no clean review comment, so the required automated signal did not complete successfully. Human review is needed before merge; no reviewers were assigned because the PR author is the sole maintainer on these paths.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f8f2f32a43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a7067c52-5120-4553-b310-64c72828e4f1)

[cursor]

Risk: low. Not approving: Cursor Bugbot completed as skipped (usage limit reached) with no clean review signal. Human review is needed before merge; no reviewers assigned because the PR author is the sole maintainer on these paths.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}