ci: drop redundant main-push build; add concurrency cancel

[attson]

Summary

build.yml was triggering on push: branches: [main], but every artifact upload and the release job are gated on if: startsWith(github.ref, 'refs/tags/v'). So each squash-merge into main kicked off a full matrix build (linux × 2 arch + darwin × 2 arch + windows) that ran vet/test/build and then skipped every output step — pure waste, typically 10+ minutes of CI per merge for an OSS project where every change lands via PR (which had already verified the same code).

Changes

on:
  push:
    tags: ['v*']            # was: branches: [main], tags: ['v*']
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: build-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

• Drop push: branches:[main] — PR already gates merges to main. Direct pushes to main are rare and (per project convention) avoided.
• Keep push: tags:['v*'] — release flow is unchanged: git tag vX.Y.Z && git push --tags still triggers the full matrix build + artifact upload + GitHub Release.
• Keep pull_request and workflow_dispatch — pre-merge gate and manual re-run.
• Add concurrency keyed on github.ref. When a PR is updated multiple times in quick succession, the older run is cancelled. Tag pushes use a distinct ref (refs/tags/vX.Y.Z) so a release build is never aborted by an unrelated PR update.

What still works

• Open a PR → CI runs (same as before, just without the duplicate on merge)
• Merge → no CI run (PR already verified)
• Push a release tag → full matrix build + artifacts + GitHub Release (unchanged)

What changes

• Direct pushes to main (bypassing PR) will no longer run CI. We don't do this, so accepting the trade-off.

Test Plan

• This PR's own CI run uses the new concurrency group (visible under "Actions" once the PR is open)
• After merge, no follow-up build runs on the resulting main commit
• Next time you git tag vX.Y.Z && git push --tags, the release flow still produces full artifacts