ci: isolate stable qualification caller concurrency

[ss-o]

Summary

The first main-push qualification after #630 failed before any ZD jobs started: the caller's push concurrency group equals the pinned ZD workflow's inherited workflow-name/ref group. Give the qualification caller its own group suffix so the called workflow cannot cancel its caller. Keep cancellation of superseded qualification runs and all six constituent gates intact.

Refs #628. This prerequisite repairs post-merge qualification under the existing source guard before the protected-main cutover in #631. No source-policy or repository settings change is included.

Verification

• Main run 37948680006 failed with ZD_RESULT: failure, no ZD jobs, and all other constituent jobs successful. The pinned ZD workflow uses ${{ github.workflow }}-${{ github.ref }}; the previous caller expands to that same value on a main push. GitHub's reusable-workflow reference documents the inherited-name cancellation hazard.
• The new push-group regression failed on the unmodified workflow and passes after the suffix change. All existing failure, cancelled and skipped aggregate cases still pass their rejection tests.
• Native Zsh syntax, stable-qualification and CI-registration tests, actionlint and diff checks pass. The commit hook checks both affected files with Trunk; hosted current-head qualification remains required before merge.

Agent handoff

• Status: Prerequisite repair candidate.
• Next steps: Review and merge through the existing guard, verify full qualification on the delivered main SHA, then update and requalify fork cutover chore: cut over Zi integration to protected main #631. Retain current protections and next while evidence is pending; no tag or release is authorized.

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on cd8ccf6.

Reviewed base and merge-base 6840325 and exact head cd8ccf6 under the repository code-review procedure and bundled organization criteria. No actionable findings or unresolved review threads.

Correctness and concurrency: the main-push caller group previously equalled the pinned ZD reusable workflow group, because the called workflow inherits the caller workflow name. Appending the caller suffix separates their cancellation scopes while retaining cancellation of superseded caller runs. The aggregate still requires all six constituents and fails for failed, skipped or cancelled results. The regression rejects the original colliding push group and exercises the actual aggregate command.

Compatibility and security: the changed shell file is a standalone native-Zsh test. Native syntax and the stable-qualification regression pass; CI registration passes. Action references, candidate checkout inputs, supported Zsh matrix, permissions, release behavior and repository protection remain unchanged. No dependency or loader/API changes. Targeted Trunk checks pass.

Hosted verification: full stable qualification run 37951359617 passed every Linux/macOS Zsh 5.8.1, 5.9 and 5.9.2 leg, ZD including compatibility, Trunk, CodeQL, clean startup and real-object lifecycle checks. All other PR checks pass on the reviewed head, and GitHub reports the branch mergeable. The Copilot request did not register; its cause is unconfirmed.

Verification limit: PR qualification does not prove the repaired main-push path. After normal protected merge, verify the full qualification workflow on the exact resulting main SHA before applying the protected-main migration. This hotfix does not complete issue #628 or authorize a tag, release or protection bypass.