chore(ci): repoint push-email-notify to smtp-notify-action

Replaces dawidd6/action-send-mail with hyperpolymath/smtp-notify-action v0.2.0 (ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) per the 2026-09-02 ruling; file is the rsr-template-repo canonical (dormant gating on vars.PUSH_EMAIL_ENABLED unchanged). regime=lock pristine=valid post=valid changed=.github/workflows/actions.lock,.github/workflows/push-email-notify.yml,

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/actions.lock

@@ -11,7 +11,7 @@ workflows:
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/push-email-notify.yml':
-        - 'hyperpolymath/smtp-notify-action@v0.1.0'
+        - 'hyperpolymath/smtp-notify-action@v0.2.0'
     '.github/workflows/secret-scanner.yml': []
 dependencies:
     'actions/checkout@v7.0.1':
@@ -24,8 +24,8 @@ dependencies:
         commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
         owner_id: 9919
         repo_id: 259445878
-    'hyperpolymath/smtp-notify-action@v0.1.0':
-        ref: 'v0.1.0'
-        commit: 'sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050'
+    'hyperpolymath/smtp-notify-action@v0.2.0':
+        ref: 'v0.2.0'
+        commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
         owner_id: 6759885
         repo_id: 1352485172

.github/workflows/push-email-notify.yml

@@ -14,6 +14,22 @@ on:
   push:
     # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit.
     branches: ['**']
+concurrency:
+  # Deliberately per-RUN, so no run is ever queued behind another and none is
+  # ever cancelled. Do NOT "tidy" this into a shared group such as
+  # ${{ github.workflow }}-${{ github.ref }}. GitHub's workflow-syntax docs:
+  # "By default, any existing pending job or workflow in the same concurrency
+  # group will be canceled and the new queued job or workflow will take its
+  # place." That happens regardless of cancel-in-progress, which governs only
+  # the RUNNING job. On this workflow it silently loses a notification email,
+  # with no error anywhere. Every run here reports a DISTINCT commit, so there
+  # is no redundant work for a concurrency limit to remove.
+  # The docs also offer `queue: max` (up to 100 pending); not used, because 100
+  # is still a cap whereas a per-run group needs none.
+  # Verified with zizmor 1.30.0: deleting this block raises concurrency-limits;
+  # this form silences it exactly as a shared group would.
+  group: push-email-${{ github.run_id }}
+  cancel-in-progress: false
 permissions:
   contents: read
 jobs:
@@ -24,7 +40,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050)
+        uses: hyperpolymath/smtp-notify-action@v0.2.0 # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7)
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}