fix(ci): preserve every started job

[rldyourmnd]

Summary

Makes preservation of every started CI job an executable library invariant. Removes cancellation from all self-workflows and consumer examples, updates the performance/free-tier agent skills, and rejects future cancellation expressions in the workflow contract.

Type of change

• Fix to an existing workflow
• Hardening / security posture improvement

Threat-model note (required for workflow / permission changes)

No new action, token, permission, runner, egress, or external input is introduced. Runs may queue or execute concurrently instead of being cancelled. This preserves complete evidence and prevents a newer ref from erasing the result of already executing code.

Permissions diff (required for workflow / permission changes)

No permissions changed. Every existing top-level and job-level permission remains byte-identical.

Checklist

• All third-party actions remain pinned to full commit SHAs.
• Least-privilege permissions unchanged.
• Existing concurrency and timeout declarations retained.
• Checkout credential policy unchanged.
• No expressions added to run scripts.
• Tier boundaries unchanged.
• Public hosted CI is the authoritative verification.
• Public hosted CI is the authoritative security analysis.
• Documentation, executable contract, canonical skills and Claude mirrors updated.
• CHANGELOG updated under Unreleased.
• Commit is signed and signed off.

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (GHAS / harden-runner features)

Runtime policy

No synthetic Drakkars workload is created. Private fleet runtime evidence continues to come only from real consumer project jobs.