fix(cic): address CI-split review - restore PR concurrency, fix comment migration, restore deleted spec block

Per review on PR #2768:

- Restore a concurrency block in ci.yml (cancel-in-progress: true) so a fresh
  PR push cancels the superseded run; GitHub has no default PR auto-cancel,
  so removing it would stack a second full 9-job run on every push.
  Update the ci-workflow.spec assertion accordingly.
- Fix comment misplacements from the split boundary: ci.yml's all-checks-passed
  now carries its own branch-protection comment (the drill comment that was
  orphaned above it is gone), and ci-master.yml no longer ends with an orphaned
  all-checks-passed comment.
- Restore the DeepSeek e2e workflow describe-block in ci-workflow.spec.ts that
  the rewrite had silently deleted (e2e.yml is unchanged).
- serial-windows comment no longer claims non-blocking-for-PR/absent-from-needs
  since ci-master never listens to pull_request.
- DSH_TELEMETRY_DISABLED safe-use comment restored in ci-master.yml env; split
  rationale (mi gray segments in PR check) documented in .github/AGENTS.md.

Verification: ci-workflow.spec.ts 13/13, both workflows YAML-parse with correct
concurrency, git diff --check clean.

.github/workflows/ci.yml

@@ -7,8 +7,17 @@ permissions:
 
 env:
   PRIMARY_NODE_VERSION: '24'
+  # CI runs must never report to the production telemetry endpoint baked
+  # into apps/cli/cordis.yml (AppCLIEntry disables the row when set).
   DSH_TELEMETRY_DISABLED: '1'
 
+# Cancel a superseded pull-request run on a new push so a fresh head does not
+# queue a second full 9-job run behind a stale one (paid enterprise runners
+# would otherwise stack with no auto-cancellation).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
 
   # Three enterprise jobs isolate coverage, static analysis, and the
@@ -433,19 +442,16 @@ jobs:
         shell: pwsh
         run: pnpm run check:ci:windows-complete
 
-  # Hot-standby drill for the in-house self-hosted pool: every master move
-  # re-runs the complete unsharded aggregate on the persistent 64-core VM,
-  # continuously proving that environment can take over a required lane if
-  # the hosted pools degrade (the switch is then setting the writer-manageable
-  # DSH_CI_FAILOVER_LINUX variable — see the failover runbook, no merge required).
-  # Push-triggered, so this lane always executes the base branch's own
-  # workflow definition. (Under failover, pull_request jobs do reach these
-  # runners with the PR merge ref's workflow — the boundary there is
-  # repository membership: private, forking disabled, Dependabot excluded.)
-  # Non-blocking for
-  # pull requests; no cache steps because the VM's persistent pnpm store and
-  # tool caches make them redundant (and saving here would poison the hosted
-  # cache namespace with self-hosted paths).
+  # Single stable required check for branch protection: require "all checks
+  # passed" instead of enumerating matrix legs whose names change as lanes and
+  # node versions evolve. Every blocking job in THIS workflow must be listed in
+  # `needs`. The required Wine job is listed as `windows`; `windows-native` is
+  # deliberately absent so its independent result never delays or changes this
+  # verdict.
+  # `if: always()` is load-bearing: without it a failed dependency
+  # would SKIP this job, and GitHub counts a skipped required check as passing
+  # — so this job always runs and fails on any non-success result, including
+  # 'cancelled' and 'skipped'.
   all-checks-passed:
     name: all checks passed
     # This bookkeeping-only verdict must not depend on custom-pool