ci: avoid duplicate workflow runs on pull requests

Limit push triggers to master so PR branch updates only run once via
pull_request, and cancel superseded in-progress runs with concurrency groups.

.github/workflows/rust-core.yml

@@ -8,6 +8,10 @@ on:
       - "crates/vnidrop/**"
       - ".github/workflows/rust-core.yml"
   push:
+    # Only after merge (or direct master pushes). Feature-branch work is covered
+    # by pull_request so we do not run the same job twice on every PR update.
+    branches:
+      - master
     paths:
       - "Cargo.toml"
       - "Cargo.lock"
@@ -17,6 +21,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: rust-core-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   quality:
     runs-on: ubuntu-latest

.github/workflows/shared-kmp.yml

@@ -37,6 +37,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: shared-kmp-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   jvm-test:
     # Host Rust embedding is enabled only for the current Gobley host target.