🗒️ Description

This PR tries to eliminate the most obvious inefficiency in our current CI: Duplicated tox_verify runs, e.g.

It won't make individual jobs quicker, but it will stop jobs getting queued up and delaying CI for a PR.

It eliminates redundant CI executions by:

• Limiting 'push' triggers to only the 'main' branch for post-merge verification.
• Using 'pull_request' for PR validation to run exactly once per commit.
• Adding concurrency control to cancel in-progress runs when new commits are pushed.

Before the change:

• Push to any branch → CI runs.
• Open/update PR → CI runs.
• Push to PR branch → CI runs twice (push + pull_request events).

After the change:

• Push to main only → CI runs
• Push to any other branch without PR → No CI runs
• Open/update PR → CI runs once (pull_request event only)

Key differences:

1. ✅ Push to main: Still triggers CI (for post-merge verification)
2. ❌ Push to feature branch without PR: No longer triggers CI
3. ✅ PR commits: Triggers CI exactly once instead of twice
4. ✅ Merging branch into branch: Still works (via pull_request event)

🔗 Related Issues or PRs

N/A.

✅ Checklist

• All: Ran fast tox checks to avoid unnecessary CI fails, see also Code Standards and Enabling Pre-commit Checks:

  uvx --with=tox-uv tox -e lint,typecheck,spellcheck,markdownlint

• All: PR title adheres to the repo standard - it will be used as the squash commit message and should start type(scope):.
• All: Considered adding an entry to CHANGELOG.md. skipped
• All: Considered updating the online docs in the ./docs/ directory.
• All: Set appropriate labels for the changes (only maintainers can apply labels).