ci: stop dependabot from triggering heavy workflows

[EmersonBraun]

What changed

Ports the CI-minute guard from AgentsKit-io/agentskit#1579 to this repo.

• Added a top-level concurrency block to the three workflows that have a
  pull_request trigger and no existing one — ci.yml, codeql.yml,
  dependency-review.yml. In-flight runs for the same PR are superseded; pushes
  to main always finish (cancel-in-progress is gated on
  github.event_name == 'pull_request').
• Added open-pull-requests-limit: 3 to both updates: entries in
  .github/dependabot.yml (github-actions, npm).

No job was skipped on dependabot PRs in this repo. The only PR job is check
in ci.yml (npm run check + npm pack --dry-run), which is the main CI, plus
CodeQL and dependency-review. All three must keep running so a dependency bump is
never merged unvalidated. There are no e2e, lighthouse, visual-regression,
coverage, docs-build, link-check, bundle-size, citation or eval workflows here.

publish.yml was left untouched even though it has a pull_request trigger: it
is the npm publish + GitHub release workflow (types: [closed], merged version
PRs only), and cancelling a publish mid-run is unsafe. release.yml already has
its own concurrency block, and scorecard.yml has no pull_request trigger.

Why

Dependabot bumps were spending CI minutes on redundant runs, and superseded
pushes to a PR branch were left running to completion. Concurrency reclaims the
superseded runs; the PR cap bounds how many dependabot branches are open at once.

Verification

• npm run check — not run locally; this change touches only .github/ and
  no source, and CI will run it on this PR
• Every edited YAML file still parses (python3 -c "import yaml; yaml.safe_load(...)")
• Public CLI or Action changes are documented — n/a, no public surface changed
• No secrets or private model output are included

🤖 Generated with Claude Code

https://claude.ai/code/session_015eDrUXwb4BZWXUuwpNMkDn

---

Generated by Claude Code