fix(ci): a standing release PR ran every development push twice (#3370)

Every push to `development` fired Code Quality TWICE on the same commit —
once for the `push` event, once for the `pull_request` event of the
permanently-open "Release: merge development into beta", whose `head_ref`
IS `development`.

Measured here 2026-09-03: runs 33747123932 (push) and 33747129312
(pull_request), same sha b8eb72e, created four seconds apart, both running
the full suite to completion.

The concurrency block above them is not the bug and must not be "fixed":
it suffixes the group by event name deliberately so the push run is NOT
cancelled by the PR run, because the push run is the only carrier of
Coverage Baseline Check, SBOM and Features Extract. That is correct. The
consequence is simply that both lanes run.

So the duplicate has to be dropped at the job, and the PR run is the one to
drop: its head sha is development's, which the push run already decided,
and it runs strictly fewer jobs.

Not done by removing `beta` from `pull_request.branches`, though that would
also stop it. The `release/v*` and `sync/main-to-beta` PRs target `beta` as
well and genuinely need their run; only the `head_ref: development` PR is
redundant. A `development -> main` promotion PR is skipped by the same
clause, for the same reason and just as correctly.

Scope: 20 of the fleet's 21 apps carry `beta` in `pull_request.branches`
and pay this on every development push. dossiq is the exception and does
not. This lands the fix here first; the rest follow once a development push
here shows one Code Quality run instead of two.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/code-quality.yml

@@ -172,7 +172,31 @@ permissions:
 
 jobs:
   quality:
-    if: github.event_name != 'push' || github.event.created != true
+    # SECOND CLAUSE: skip the run a STANDING release PR triggers.
+    #
+    # `Release: merge development into beta` is permanently open with
+    # `head_ref: development`, so every push to development fires this
+    # workflow TWICE on the SAME sha — once for `push`, once for that PR's
+    # `pull_request` event. The concurrency block above deliberately gives
+    # them separate lanes so the push run is not cancelled, which is right,
+    # and the consequence is that both run to completion.
+    #
+    # The PR run is the redundant one, not the push run: its head sha IS
+    # development's, which the push run already decided, and the push run
+    # carries jobs the PR run does not (Coverage Baseline Check, SBOM,
+    # Features Extract). Measured 2026-09-03: runs 33747123932 (push) and
+    # 33747129312 (pull_request), same sha b8eb72e2, four seconds apart.
+    #
+    # 20 of the fleet's 21 apps carry `beta` in `pull_request.branches` and
+    # so pay this on every development push. Removing `beta` from that list
+    # would also work and is worse: the `release/v*` and `sync/main-to-beta`
+    # PRs genuinely need their run, and they target `beta` too.
+    #
+    # A `development -> main` promotion PR is skipped by the same clause, for
+    # the same reason and just as correctly.
+    if: >-
+      (github.event_name != 'push' || github.event.created != true)
+      && (github.event_name != 'pull_request' || github.head_ref != 'development')
     uses: ConductionNL/.github/.github/workflows/quality.yml@main
     with:
       app-name: openregister