fix: scope deploy triggers and cancel stale workflow runs

Limit workflow path triggers to each workflow file, add concurrency groups to cancel outdated runs, and checkout the exact triggering SHA for deterministic deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy-claude-dev-dev.yml

@@ -11,6 +11,10 @@ on:
         description: 'Optional full image ref (for rollback), e.g. claude-dev:dev-abc123'
         required: false
 
+concurrency:
+  group: deploy-claude-dev-dev
+  cancel-in-progress: true
+
 jobs:
   deploy-claude-dev-dev:
     runs-on: ubuntu-latest
@@ -19,8 +23,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/claude-dev:/claude-dev-runtime
     steps:
-      - name: Checkout dev branch
+      - name: Checkout exact commit
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
 
       - name: Resolve image tags
         run: |

.gitea/workflows/deploy-dev.yml

@@ -4,7 +4,11 @@ on:
     branches: [dev]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy-dev.yml'
+
+concurrency:
+  group: deploy-dashboard-dev
+  cancel-in-progress: true
 
 jobs:
   deploy-dev:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout dev branch
+      - name: Checkout exact commit
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build dev image
         run: DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
       - name: Deploy dev

.gitea/workflows/deploy.yml

@@ -4,7 +4,11 @@ on:
     branches: [main]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy.yml'
+
+concurrency:
+  group: deploy-dashboard-main
+  cancel-in-progress: true
 
 jobs:
   deploy:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout
+      - name: Checkout exact commit
-        run: git clone --depth 1 http://gitea:3000/jimmy/nas-tools.git .
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build
         run: DOCKER_BUILDKIT=0 docker build -t nas-dashboard:latest dashboard/
       - name: Deploy