ci: smooth blacksmith worker bursts

Cap ClawHub Blacksmith worker fanout and cancel superseded Testbox runs to reduce org runner-registration bursts.

.github/workflows/ci-check-testbox.yml

@@ -11,6 +11,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: clawhub-testbox-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   BUN_VERSION: "1.3.10"
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

.github/workflows/security-scan-codex.yml

@@ -37,6 +37,7 @@ jobs:
     environment: Production
     strategy:
       fail-fast: false
+      max-parallel: 2
       matrix:
         shard: [0, 1, 2, 3]
     env:

.github/workflows/skill-card-worker.yml

@@ -34,6 +34,7 @@ jobs:
     environment: Production
     strategy:
       fail-fast: false
+      max-parallel: 2
       matrix:
         shard: [0, 1, 2, 3]
     env: