ci: one CI path — .hanzo/workflows

cicd.yml was the only file under .github/workflows, so nothing else was
switched off by creating this directory — but two things had to move together,
and the second is the one that is easy to miss.

Gitea collects workflows from the FIRST of WORKFLOW_DIRS that exists in the
pushed commit and ignores the rest (modules/actions/workflows.go,
listWorkflowsInDirs breaks on the first hit). Narrowing WORKFLOW_DIRS to
.hanzo/workflows alone is what makes every vendored third-party fork on this
forge inert by construction, and it also means a pipeline left under
.github/workflows is not collected at all: no run, no queued job, no error.

The `uses:` path had to move with it. A reusable is resolved through
services/actions.ResolveUses, which enforces the SAME directory allowlist on
the referenced path, so `hanzoai/ci/.github/workflows/build.yml@v1` would have
stopped resolving at that change — migrating the caller alone only trades a
silent no-collect for a silent no-resolve. hanzoai/ci publishes build.yml at
both paths from the same tag, byte-identical apart from its header, so the
.hanzo path resolves the identical pipeline. @v1 is unchanged.

Adds the per-ref concurrency group the fleet now requires. Nothing else
changed: same triggers, same hanzo.yml, same runner (the hanzoai/ci default
hanzo-build-linux-amd64, which the git-runners actually advertise).

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/cicd.yml

@@ -1,13 +0,0 @@
-# ~7-line canonical caller — all real config lives in /hanzo.yml.
-# Builds + pushes the agent-skills artifact on OUR arc pool; auto-mirrors to
-# registry.hanzo.ai.
-name: CI/CD
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-  pull_request:
-jobs:
-  cicd:
-    uses: hanzoai/ci/.github/workflows/build.yml@v1
-    secrets: inherit

.hanzo/workflows/cicd.yml

@@ -0,0 +1,46 @@
+name: CI/CD
+
+# The ~7-line canonical caller: triggers plus the import. All real config lives
+# in the repo-root hanzo.yml, which platform.hanzo.ai reads too.
+# Builds + pushes the agent-skills artifact; auto-mirrors to registry.hanzo.ai.
+#
+# Both the directory AND the `uses:` path moved, and the second is the one that
+# is easy to miss.
+#
+# Gitea collects workflows from the FIRST of WORKFLOW_DIRS that exists in the
+# pushed commit and ignores the rest (modules/actions/workflows.go,
+# listWorkflowsInDirs breaks on the first hit), so once that list narrows to
+# .hanzo/workflows alone, a pipeline left under .github/workflows is simply not
+# collected: no run, no queued job, no error.
+#
+# And a reusable is resolved through services/actions.ResolveUses, which
+# enforces the SAME directory allowlist on the referenced path:
+#   "uses:" path %q must be under a configured workflow directory
+# So `hanzoai/ci/.github/workflows/build.yml@v1` stops resolving at that point
+# too. Moving the caller without the callee path only trades a silent
+# no-collect for a silent no-resolve.
+#
+# hanzoai/ci publishes build.yml at BOTH paths from the same tag, byte-identical
+# apart from its header (GitHub resolves only .github/workflows, git.hanzo.ai
+# only .hanzo/workflows), so this is the same pipeline at the same @v1.
+#
+# The runner is unchanged because it was already right: hanzoai/ci defaults to
+# ["hanzo-build-linux-amd64"], which the git-runners actually advertise.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+
+# Not cancellable: hanzo.yml declares `images:`, so a superseded run may already
+# have pushed a layer under the tag it was given.
+concurrency:
+  group: cicd-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  cicd:
+    uses: hanzoai/ci/.hanzo/workflows/build.yml@v1
+    secrets: inherit

hanzo.yml

@@ -1,5 +1,5 @@
 # Canonical CI config for hanzoai/openapi — read by the hanzoai/ci reusable
-# (.github/workflows/cicd.yml) and platform.hanzo.ai.
+# (.hanzo/workflows/cicd.yml) and platform.hanzo.ai.
 #
 # Publishes the agent-skills catalog (/.well-known/agent-skills, skills.py
 # --no-services) as a versioned immutable image whose rootfs is /catalog.