ci: collapse the push/pull_request double-fire in the concurrency group

`group: ${{ github.workflow }}-${{ github.ref }}` cannot collapse a push and
its pull_request run, because the same commit is refs/heads/<branch> on push and
refs/pull/N/merge on the PR. Both runs go to completion on identical bytes —
verified across the org on armature runs 34111791960 (push) and 34111797073
(pull_request): same head_sha, four seconds apart, both running the full matrix.

Using `github.head_ref || github.ref` gives both events the same group key on a
PR branch, so the push run is superseded and every PR costs one matrix, not two.
head_ref is empty outside pull_request, so pushes to main keep grouping by ref.

Part of the org-wide CI-minute sweep. Per dogfood-swarm SKILL item 9.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mcp-tool-shop

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs: