fix(community): isolate project sync events

[openai0229]

Related issue

Closes #1946

Summary

• Isolate Community Project workflow concurrency by Issue or pull-request number so unrelated events cannot cancel each other's pending synchronization.
• Keep scheduled and manual full-board reconciliation serialized under a shared reconcile key.
• Add a source-level regression test for the concurrency contract while preserving cancel-in-progress: false.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • node --test script/github/issue-claim.test.js script/github/sync-community-project.test.js - passed, 33 tests.
  • ruby script/github/validate-community-operations.rb - passed.
  • actionlint .github/workflows/community-project-sync.yml - passed.
  • ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/community-project-sync.yml"), aliases: false)' - passed.
  • git diff --check - passed.
• Manual verification: The production run history after feat(community): operationalize contribution workflow #1939 showed unrelated Project sync runs entering one repository-wide concurrency group; this PR narrows the key to the event content number.
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: N/A; no application API or stored data changes.
• Database or driver compatibility: N/A; no database code changes.
• Network, privacy, or security: The existing Project token and permissions are unchanged.
• Community / Local / Pro boundary: Community repository automation only.
• Backward compatibility: Lifecycle mapping and scheduled reconciliation behavior are unchanged; only event serialization changes.

Reviewer map

• Start here: .github/workflows/community-project-sync.yml, then the concurrency contract in script/github/sync-community-project.test.js.
• Failure condition: Two different Issue or pull-request events still share one concurrency key, or manual/scheduled reconciliation no longer serializes.
• Rollback or disable path: Revert this commit to restore the repository-wide concurrency group.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: Codex identified the cancellation pattern from live workflow runs, implemented the scoped concurrency key and test, and ran the reported verification. The maintainer retains responsibility for the workflow policy.

[github-actions]

Reviewed 7506509: 0 critical, 1 high, 0 medium findings.

Merge recommendation: request changes. The concurrency key must distinguish Issue and pull-request event types when their numeric IDs match; otherwise an unrelated pending synchronization can be displaced.

Coverage: reviewed the complete current patches for both changed files plus PR metadata, existing reviews, and line comments. No tests or runtime checks were run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by AI Pull Request Reviewer for #1947 · 7.5 AIC · ⌖ 1.57 AIC · ⊞ 17.8K

[github-actions]

Reviewed 3a315c46: 0 critical, 0 high, 0 medium findings.

Merge recommendation: no blocking findings. The prior high-severity concurrency collision is addressed by distinct issue and pull-request suffixes while scheduled and manual runs retain the shared reconcile key.

Coverage: reviewed the complete current patches for both changed files, PR metadata, existing reviews, and line comments. No tests or runtime checks were run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by AI Pull Request Reviewer for #1947 · 5.66 AIC · ⌖ 2.77 AIC · ⊞ 16.9K

Superseded by updated review from same workflow.