ci: cancel the runs of a branch that is closed

The concurrency group only deduplicates live work on a branch; a run that was queued or still building kept its runner after the branch was deleted or its pull request closed. A delete and a pull_request closed trigger now cancel everything of that branch that has not completed, minus the cancelling run itself, which shares the head branch on a pull request event.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/cancel.yml

@@ -0,0 +1,30 @@
+name: Cancel runs
+
+on:
+  delete:
+  pull_request:
+    types:
+      - closed
+
+permissions:
+  actions: write
+
+jobs:
+  cancel:
+    name: Cancel the runs of a closed branch
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' || github.event.ref_type == 'branch'
+
+    steps:
+      - name: Cancel every queued or running workflow of the branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.event.ref }}
+        run: |
+          set -euo pipefail
+          gh run list --branch "${BRANCH}" --limit 100 \
+            --json databaseId,status \
+            --jq '.[] | select(.status != "completed") | .databaseId' \
+            | sed "/^${GITHUB_RUN_ID}$/d" \
+            | xargs -r -n1 gh run cancel