fix(cic): address CI-split review - restore PR concurrency, fix comment migration, restore deleted spec block

Per review on PR #2768:

- Restore a concurrency block in ci.yml (cancel-in-progress: true) so a fresh
  PR push cancels the superseded run; GitHub has no default PR auto-cancel,
  so removing it would stack a second full 9-job run on every push.
  Update the ci-workflow.spec assertion accordingly.
- Fix comment misplacements from the split boundary: ci.yml's all-checks-passed
  now carries its own branch-protection comment (the drill comment that was
  orphaned above it is gone), and ci-master.yml no longer ends with an orphaned
  all-checks-passed comment.
- Restore the DeepSeek e2e workflow describe-block in ci-workflow.spec.ts that
  the rewrite had silently deleted (e2e.yml is unchanged).
- serial-windows comment no longer claims non-blocking-for-PR/absent-from-needs
  since ci-master never listens to pull_request.
- DSH_TELEMETRY_DISABLED safe-use comment restored in ci-master.yml env; split
  rationale (mi gray segments in PR check) documented in .github/AGENTS.md.

Verification: ci-workflow.spec.ts 13/13, both workflows YAML-parse with correct
concurrency, git diff --check clean.

.github/workflows/ci-master.yml

@@ -28,6 +28,8 @@ permissions:
 
 env:
   PRIMARY_NODE_VERSION: '24'
+  # CI runs must never report to the production telemetry endpoint baked
+  # into apps/cli/cordis.yml (AppCLIEntry disables the row when set).
   DSH_TELEMETRY_DISABLED: '1'
 
 jobs:
@@ -143,11 +145,11 @@ jobs:
   # `windows` lane if the hosted pool degrades (the switch is setting the
   # writer-manageable DSH_CI_FAILOVER_WINDOWS variable — see the failover
   # runbook, no merge required). Push-triggered, so this lane always executes
-  # the base branch's own workflow definition. Non-blocking for pull requests;
-  # absent from all-checks-passed.needs by design — the required `windows` job
-  # owns the PR verdict. No cache steps because the VM's persistent pnpm store
-  # and tool caches make them redundant (and saving here would poison the
-  # hosted cache namespace with self-hosted paths).
+  # the base branch's own workflow definition. This workflow never listens to
+  # pull_request, so the drill does not appear in PR checks. No cache steps
+  # because the VM's persistent pnpm store and tool caches make them redundant
+  # (and saving here would poison the hosted cache namespace with self-hosted
+  # paths).
   serial-windows:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     name: serial / windows (self-hosted standby)
@@ -393,15 +395,3 @@ jobs:
         env:
           DSH_GATE_CONCURRENCY: ${{ matrix.workers }}
         run: pnpm run check:ci:windows-blocking
-
-  # Single stable required check for branch protection: require "all checks
-  # passed" instead of enumerating matrix legs whose names change as lanes and
-  # node versions evolve. Every blocking job in THIS workflow must be listed in
-  # `needs`. The required Wine job is listed as `windows`; `windows-native` is
-  # deliberately absent so its independent result never delays or changes this
-  # verdict. (`needs` cannot reach across workflow files; e2e.yml stays its own
-  # check.)
-  # `if: always()` is load-bearing: without it a failed dependency
-  # would SKIP this job, and GitHub counts a skipped required check as passing
-  # — so this job always runs and fails on any non-success result, including
-  # 'cancelled' and 'skipped'.