chore(ci): reduce GitHub Actions spend

[dylanjeffers]

Goal

Cut GitHub Actions spend across web/identity/sdk CI.

Changes

• Concurrency cancellation (web, identity, sdk): add cancel-in-progress keyed on the PR branch, so pushing new commits to a PR cancels the superseded in-flight run. Keyed as ${{ github.head_ref || github.ref }} with cancel-in-progress: ${{ github.event_name == 'pull_request' }} so main deploys are never cancelled by a subsequent push.
• Opt-in web preview (web): web-deploy-preview now requires a preview label on the PR. Most PRs don't need a live Cloudflare preview, and each one is a build download + two wrangler deploys. Add the preview label to get a preview URL.
• Dead path filters (web, mobile): removed .circleci/** from paths: — CircleCI is fully removed, so those entries never match.

Not changed (already lean)

• Mobile macos-26 jobs (10× cost) already run only on push to main + when the app version changed, and mobile has no pull_request trigger at all — so macOS spend is already minimized. Left as-is.

Estimated savings

Concurrency cancellation saves on every multi-push PR (web runs 6 ubuntu jobs per run); preview gating removes a deploy job from the majority of PRs. Rough estimate **$5–8/mo** of the ~$36/mo.

⚠️ Reviewer check

The preview-label gate changes dev workflow (previews become opt-in). If the team prefers previews-by-default, say so and I'll drop that hunk — the concurrency + dead-path cleanups stand on their own.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: f2b6b43

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.