fix(ci): freeze yolo and cancel stale CI runs

What:
- disable hourly yolo schedule during recovery
- add CI concurrency so only the latest main run survives
- scope yolo write access to the job that still needs to push

Why:
- stop pin-drift noise while main is red
- make one current CI run readable again
- reduce workflow write authority while recovery is in progress

Tests:
- none (workflow-only change)

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
     branches: [ main ]
   workflow_dispatch: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   linux:
     runs-on: ubuntu-latest

.github/workflows/yolo-update.yml

@@ -1,13 +1,11 @@
 name: Yolo Update Pins
 
 on:
-  schedule:
-    - cron: "5 * * * *"
   workflow_dispatch: {}
 
 permissions:
   actions: read
-  contents: write
+  contents: read
 
 concurrency:
   group: yolo-update-pins
@@ -46,6 +44,9 @@ jobs:
     needs: guard
     if: ${{ needs.guard.outputs.should_run == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4