ci: merge the cheap script gates into one job; cancel superseded bench runs

.github/workflows/build-container.yml

@@ -7,6 +7,11 @@ on:
       - '.github/workflows/build-container.yml'
   workflow_dispatch:
 
+concurrency:
+  # Only the latest revision needs validation; a superseded run is wasted runner time.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-and-push:
     runs-on: ubuntu-24.04

.github/workflows/check-android-dependency-alignment.yml

@@ -1,6 +1,6 @@
 name: Check Android dependency 16 KB alignment
 
-# check-16k-page-alignment.yml reads every TRACKED artifact. Most native code a
+# source-gates.yml (the 16 KB step) reads every TRACKED artifact. Most native code a
 # Codename One Android app ships is not tracked: the builder writes Maven
 # coordinates into the generated build.gradle (PlatformFeatureCatalog entries,
 # the play-services defaults) and Gradle downloads them on the build machine.

.github/workflows/python-bench.yml

@@ -31,6 +31,11 @@ on:
       - 'maven/pom.xml'
   workflow_dispatch:
 
+concurrency:
+  # Only the latest revision needs validation; a superseded run is wasted runner time.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   # The pr-ci-container image lives on ghcr; without this the job dies in