Apply platform.yml only after the checks pass, and never cancel a pending apply

[TakGN]

Two fixes to the platform workflow.

1. Apply only after the repo checks pass

On a merge, checks (ci.yml) and platform started side by side, so a commit could be approved and applied to the boxes while its lint, syntax or manifest checks were failing.

• ci.yml is also a reusable workflow (workflow_call). It has no event conditions or secrets, so it behaves the same when called.
• platform.yml calls it for the commit on a merge (and on a manual apply), and apply needs it (implicit success(): every check job must pass).
• So the production approval request only appears once the checks are green.

merge -> checks (ansible, manifests, generated, shell) -> apply (approval) -> platform.yml

Cost: on a merge touching platform.yml's paths, the checks run twice (standalone and inside platform); a job cannot wait on another workflow.

2. A pull request's dry run can no longer cancel a pending apply

Dry runs and applies shared one workflow-level concurrency group, and GitHub keeps only one pending run per group. Pushing this branch cancelled the apply of the #2 merge while it was waiting for approval (nothing had run on the boxes). Concurrency is now per job:

• dry runs: platform-check-<ref>, a newer push to the same branch replaces the older
• applies: platform-apply, never cancelled half-way; a newer merge waiting behind replaces an older one still waiting (latest main wins)

Merging

Merging this triggers a platform run (it changes the workflow file): checks first, then the approval, then platform.yml. That run replaces the cancelled one from #2.

actionlint passes on both workflows.

🤖 Generated with Claude Code