chore(helios-cli): pin CI action SHAs and update deny.toml

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: codex

.github/workflows/blob-size-policy.yml

@@ -1,4 +1,8 @@
 name: blob-size-policy
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   pull_request: {}

.github/workflows/cargo-audit.yml

@@ -1,4 +1,8 @@
 name: cargo-audit
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:

.github/workflows/cargo-machete.yml

@@ -1,4 +1,8 @@
 name: Cargo Machete
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:

.github/workflows/cargo-semver-checks.yml

@@ -1,4 +1,8 @@
 name: cargo-semver-checks
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request: { paths: ['**/Cargo.toml'] }
   workflow_dispatch:

.github/workflows/ci.yml

@@ -1,4 +1,8 @@
 name: ci
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   pull_request: {}

.github/workflows/codeql-rust.yml

@@ -1,4 +1,8 @@
 name: CodeQL (Rust)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:

.github/workflows/codeql.yml

@@ -1,4 +1,8 @@
 name: CodeQL
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:

.github/workflows/codespell.yml

@@ -1,5 +1,9 @@
 # Codespell configuration is within .codespellrc
 name: Codespell
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:

.github/workflows/journey-gate.yml

@@ -19,6 +19,10 @@
 # =============================================================================
 
 name: Journey Gate
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:

.github/workflows/namespace-governance.yml

@@ -1,4 +1,8 @@
 name: Namespace Governance
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   pull_request: