ci: concurrency group is keyed on the branch name, so same-named fork branches can cancel each other's CI #7315

Describe the bug

ci.yml cancels in-flight runs per concurrency group, and the group for a pull request is built from github.head_ref, which is the branch name alone, with no repository or PR number:

concurrency:
  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}-${{ github.event.action == 'labeled' && github.event.label.name || github.event_name }}
  cancel-in-progress: true

github.repository here is apache/datafusion-comet for every pull request, so two open pull requests from different forks whose branches share a name land in the same group. A push to one cancels the other's in-flight run, and the cancelled pull request shows a cancelled Required Checks until someone re-runs it.

Nearly every pull request comes from a fork (194 of the 198 open ones on 2026-10-28), and contributors often use a generic branch name such as main, patch-1 or fix, so a collision does not need unusual bad luck.

codeql.yml, miri.yml and pr_title_check.yml build their group the same way. label_prs.yml already keys on github.event.pull_request.number, which is the shape to copy.

To Reproduce

Not reproduced on a real pull request. I found no cancelled run caused by this in the roughly 1,500 most recent pull requests. The nearest case is two pull requests from different forks that both used the branch fix/park-native-scan-loop and were open together for about five minutes on 2026-09-25 (#6092 and #6219), with no run in flight on the first when the second started. The behaviour follows from how the group is built, and the GitHub documentation for concurrency is explicit that a new run in a group cancels the one in progress.

To reproduce: open two pull requests from different forks with the same branch name, push to both within a run's duration, and watch the first run end cancelled.

Expected behavior

A push to one pull request cancels only that pull request's earlier run.

Additional context

Keying on the pull request number fixes it for pull request events, with the existing fallbacks for the others:

group: ${{ github.repository }}-${{ github.event.pull_request.number || github.sha }}-${{ github.workflow }}-...

ci_label.yml calls ci.yml, and the pull_request context is the same in the called workflow, so label runs keep a stable key too. arrow-rs made the same change in apache/arrow-rs#11788, with a test that two pull requests with the same branch name get different groups. dev/ci/check-ci-config.py is the place to pin it.