- One run per ref (concurrency) for CI, security, nightly and release; branch
pushes no longer duplicate pull_request runs (push is main-only).
- Deploys keep their own concurrency group so two runs never race Coolify.
- pnpm store cache on every Node job.
- New /api/version returns the deployed commit (no secrets).
- New scheduled prod-smoke workflow: readiness, db/stripe health, running
commit == main, and the document/credit routes exist (401/405, never 5xx).
