vendored-sync: cancel-in-progress can skip verification of an intermediate main commit

[realmarcin]

Minor, from the review of #196.

The new workflow sets:

concurrency:
  group: vendored-sync-${{ github.ref }}
  cancel-in-progress: true

For pull requests that is right — superseded runs on a branch are waste.

For push: branches: [main] it is slightly wrong. Two merges landing close together share the group vendored-sync-refs/heads/main, so the run for the earlier commit is cancelled and that commit is never verified. The guard is cheap (~7s) and the point of running it on main is to have a verdict per commit.

Realistic impact is small: the next push verifies the tree anyway, so drift introduced by the cancelled commit is caught seconds later by its successor, and CultureMech's nightly vendored-fleet-audit is the backstop. It matters only for attribution — a bisect over main would find a commit with no verdict.

Fix

Scope the cancellation to pull requests:

concurrency:
  group: vendored-sync-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Being addressed in #196 rather than deferred, since it is one line and in the file that PR introduces. Filed for the record per the review-to-issue rule.