From ca2ba69f0e65c40e58175fc205f887baa23974a1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:50:58 +0100
Subject: [PATCH 1/3] ci: cut Actions burn in
 .github/workflows/guix-nix-policy.yml (scope push + concurrency-cancel)

---
 .github/workflows/guix-nix-policy.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
index b8e4d6f..09494bf 100644
--- a/.github/workflows/guix-nix-policy.yml
+++ b/.github/workflows/guix-nix-policy.yml
@@ -1,6 +1,15 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Guix/Nix Package Policy
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Estate guardrail: scope push to default branches (PR fires once, not
+# push+PR) and cancel superseded runs. Safe — read-only PR check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   check:
     runs-on: ubuntu-latest

From 7583b01b4fff731765ca47fce6e9792d93106094 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:51:00 +0100
Subject: [PATCH 2/3] ci: cut Actions burn in
 .github/workflows/npm-bun-blocker.yml (scope push + concurrency-cancel)

---
 .github/workflows/npm-bun-blocker.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml
index bf8d109..a166d11 100644
--- a/.github/workflows/npm-bun-blocker.yml
+++ b/.github/workflows/npm-bun-blocker.yml
@@ -1,6 +1,15 @@
 # SPDX-License-Identifier: MPL-2.0
 name: NPM/Bun Blocker
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Estate guardrail: scope push to default branches (PR fires once, not
+# push+PR) and cancel superseded runs. Safe — read-only PR check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check:

From 3226f75d20f6f39e15cb4a8333b65a36f4fe7745 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:51:01 +0100
Subject: [PATCH 3/3] ci: cut Actions burn in .github/workflows/ts-blocker.yml
 (scope push + concurrency-cancel)

---
 .github/workflows/ts-blocker.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml
index 2fdb2c7..80c1ee0 100644
--- a/.github/workflows/ts-blocker.yml
+++ b/.github/workflows/ts-blocker.yml
@@ -1,5 +1,14 @@
 # SPDX-License-Identifier: MPL-2.0
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Estate guardrail: scope push to default branches (PR fires once, not
+# push+PR) and cancel superseded runs. Safe — read-only PR check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check: