ci: build only production branches on push; cancel stale PR jobs

[Copilot]

Feature branches were triggering two builds: one on push, one on the PR. This scopes the push trigger to production branches only (master, 2.3.x) and adds concurrency cancellation so a new PR commit kills the in-progress job.

Changes

• push trigger — add branches: [master, 2.3.x] filter; feature branch pushes no longer get a standalone build
• concurrency block — PR runs grouped by PR number with cancel-in-progress: true; production-branch push runs use run_id as group key so they are never cancelled

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}