Throttle central PR workflow queue

[seonghobae]

Summary

• limit the merge scheduler to one OpenCode/Strix dispatch per run by default
• add PR-level concurrency cancellation to central required PR workflows that were piling up superseded runs
• prevent cancelled OpenCode/Strix workflow_run completions from spawning more Noema/Scheduler work
• add a workflow queue contract test

Root cause

The central PR review merge scheduler defaulted to unlimited review/security dispatches, while several required PR workflows lacked per-PR concurrency. A wave of open PRs could enqueue many heavy CodeQL, OSV, Security Scan, Scorecard, OpenCode, Strix, Noema, and scheduler runs faster than runners could drain them. Cancelling stale OpenCode/Strix runs also exposed a second loop: cancelled workflow_run completions were still triggering Noema/Scheduler runs, refilling the queue.

Impact

Old PRs were left blocked behind queued required checks rather than being merged or clearly rejected. This change makes the queue drain gradually and prevents stale/cancelled runs from recreating the backlog.

Validation

• python3 -m pytest -s tests/test_required_workflow_queue_contract.py tests/test_codeql_pr_workflow_contract.py -q
• uv run --python 3.13 python scripts/ci/pr_review_merge_scheduler.py --self-test
• uv run --python 3.13 pytest -s -q tests/test_required_workflow_queue_contract.py tests/test_codeql_pr_workflow_contract.py tests/test_pr_review_merge_scheduler.py
• parsed all workflow YAML with PyYAML