ci(n6): gör alla workflows N6-kompletta

- ci.yml: push bara på main (pull_request täcker grenarna), kanonisk
  concurrency-grupp ${{ gitea.workflow }}-${{ gitea.ref }} med cancel-in-progress.
- masterplan-lock.yml: bara schedule -> fast grupp ${{ gitea.workflow }},
  cancel-in-progress: false.

Bara concurrency och push-filter ändras (workflow-diff-guard.py).
security.yml lämnas orörd (kanonisk fil, ägs av security-grinden).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -1,7 +1,12 @@
 name: CI (SIAX Cloud)
-on: [push, pull_request, workflow_dispatch]
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+# CI-02 concurrency (N6): en ny commit på samma PR/gren avbryter den inaktuella körningen.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 jobs:
   quality:

.gitea/workflows/masterplan-lock.yml

@@ -2,6 +2,9 @@ name: Masterplan Lock
 on:
   schedule:
     - cron: "0 4 * * *"
+concurrency:
+  group: ${{ gitea.workflow }}
+  cancel-in-progress: false
 jobs:
   lock:
     runs-on: ubuntu-latest