Limit push triggers to master so PR branch updates only run once via pull_request, and cancel superseded in-progress runs with concurrency groups.