ci: lean Actions per CI-CD-STANDARD §11 — unconditional cancel-in-progress, uv cache, drop redundant CodeQL push trigger

[ChelseaKR]

Applies CI-CD-STANDARD §11 (lean Actions) to the two workflows not yet fully aligned. Minutes are an active failure mode here — the account-wide Actions billing block means any wasted run can be the one that exhausts the quota and stops gating merges entirely — so superseded runs must cancel and redundant analyses must not re-run.

Changes

Workflow	Change	Standard
ci.yml	cancel-in-progress was ${{ github.event_name == 'pull_request' }}; now unconditionally true — superseded main-push runs cancel too (the newest push always carries its own full run, so no commit reaches main un-gated)	§11c
ci.yml	Explicit enable-cache: true on setup-uv (documents the §11f intent; v8's auto default already enabled it on hosted runners — no behavior change). release.yml keeps all caching disabled per §8c, unchanged	§11f / §8c
codeql.yml	Dropped the redundant push: main trigger; pull_request into main + weekly schedule + workflow_dispatch remain, so the scanner stays armed with automatic triggers	§11e

Already compliant (no change)

• Runners: all seven workflows are ubuntu-latest — no macos/windows anywhere (§11b).
• Concurrency: every workflow already has a concurrency group; release.yml correctly uses cancel-in-progress: false (§8b) — untouched.
• Triggers: every push: is already branches: [main] or tag-scoped (§11i); no advisory/continue-on-error jobs exist (§11d).
• Caching in release: release.yml explicitly disables uv caching in all jobs (§8c) — untouched.

Skipped (with reasons)

Item	Reason
§11h paths-ignore on ci.yml	Its verify job is a required check (ruleset protect-main: verify, standards) and runs the security stage (gitleaks/pip-audit/osv) — scanners scan everything, so no docs-skip is permissible
§11h paths-ignore on standards.yml	Required check (standards); docs changes are precisely what the freshness/policy gate should still see; job is seconds-cheap
§11f cache: pip on zizmor.yml / standards.yml setup-python	zizmor is installed with a deliberate --no-cache-dir (single small package, PR-path-filtered runs only); standards.yml installs nothing via pip
§11g matrix trim	Only matrix is CodeQL's [python, actions] language matrix — not a version matrix; N/A
Existing path filters on container-scan.yml / zizmor.yml	Pre-existing, deliberate scope (documented in-file); §11 does not require removing them and removal would raise minutes — flagging, not changing

Verification (all local — GitHub Actions is billing-blocked account-wide, so no run will appear on this PR)

• actionlint clean on both changed files (and the whole workflows dir was clean before and after).
• python3 -c 'import yaml; yaml.safe_load(...)' clean on both changed files.
• Conformance checker (--repo mode): 27/31 before → 27/31 after; actions_sha_pinned (37/37), workflow_permissions (7/7), security_scanners_armed, no_silenced_security_gate all PASS before and after. (The 4 pre-existing FAILs — ruff/mypy floors, README conformance table, i18n header — are unrelated and addressed by open PR chore(conformance): standards sweep 2026-07-16 — README conformance table + ruff/mypy floor bumps #47.)
• Full make verify (lint, mypy, 389 tests @ 97% cov, security, a11y, eval) passed locally via the repo's pre-push gate.
• Diff touches only .github/workflows/ci.yml and .github/workflows/codeql.yml; no SHA pin, permissions block, or gate altered.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JEt7d9aeBFmPToT46Sciqw