fix: scope deploy triggers and cancel stale workflow runs

Limit workflow path triggers to each workflow file, add concurrency groups to cancel outdated runs, and checkout the exact triggering SHA for deterministic deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy-dev.yml

@@ -4,7 +4,11 @@ on:
     branches: [dev]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy-dev.yml'
+
+concurrency:
+  group: deploy-dashboard-dev
+  cancel-in-progress: true
 
 jobs:
   deploy-dev:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build dev image
         run: DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
       - name: Deploy dev