fix: scope deploy triggers and cancel stale workflow runs

Limit workflow path triggers to each workflow file, add concurrency groups to cancel outdated runs, and checkout the exact triggering SHA for deterministic deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -4,7 +4,11 @@ on:
     branches: [main]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy.yml'
+
+concurrency:
+  group: deploy-dashboard-main
+  cancel-in-progress: true
 
 jobs:
   deploy:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout
-        run: git clone --depth 1 http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build
         run: DOCKER_BUILDKIT=0 docker build -t nas-dashboard:latest dashboard/
       - name: Deploy