fix(cd): queue main deployments without cancellation

.gitea/workflows/cd.yaml

@@ -24,13 +24,11 @@ on:
   workflow_dispatch:
     # 手動觸發永遠可用（用於補跑、緊急部署）
 
-# 2026-04-02 Claude Code: 改為搶佔模式 — 新 push 立即取消舊 build，只部署最新
-# 原理: concurrency group 保證同時只有一個 job 跑；cancel-in-progress:true 讓新的取代舊的
-# 解決: 多個 commit 快速連推時不再排隊堆積，且 docker build 卡住時不會阻塞後續部署
-# 安全: deploy 步驟本身有 kubectl rollout status 保護，不會出現半部署狀態
+# Main deployments run serially so concurrent writers cannot starve production closure.
+# Job timeouts, rollout verification, and deploy markers terminate or expose failed runs.
 concurrency:
   group: cd-deploy-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 env:
   HARBOR: registry.wooo.work

apps/api/tests/test_cd_post_deploy_source_link_gate.py

@@ -40,3 +40,12 @@ def test_cd_source_link_gate_uses_current_deploy_canary() -> None:
     assert "--work-item-id \"${SOURCE_LINK_CANARY_WORK_ITEM_ID}\"" in text
     assert "--expected-source-event-provider-event-id \"${SOURCE_LINK_CANARY_EVENT_ID}\"" in text
     assert "codex-sentry-20260513-t15b-v3" not in text
+
+
+def test_cd_main_pushes_queue_without_canceling_active_deploys() -> None:
+    text = _workflow_text()
+    concurrency = text.split("concurrency:", 1)[1].split("env:", 1)[0]
+
+    assert "group: cd-deploy-${{ github.ref }}" in concurrency
+    assert "cancel-in-progress: false" in concurrency
+    assert "cancel-in-progress: true" not in concurrency