CI/CD: cache pip downloads, add concurrency guards, cut a redundant docker tag (#15)

.forgejo/workflows/ops-cron.yml

@@ -26,6 +26,14 @@ jobs:
   backup:
     name: pg_dump backup
     runs-on: docker
+    # Guards against the schedule and a manual workflow_dispatch landing
+    # close together (or two manual triggers): queue rather than cancel, so
+    # a workflow_dispatch never aborts a pg_dump mid-write and leaves a
+    # truncated .dump file -- same cancel-in-progress:false rationale as
+    # deploy.yml/deploy-dev.yml's own SSH-script jobs.
+    concurrency:
+      group: ops-backup
+      cancel-in-progress: false
     steps:
       - name: Dump the prod database over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0
@@ -51,6 +59,12 @@ jobs:
   indexnow:
     name: IndexNow ping
     runs-on: docker
+    # Same overlap guard as the backup job above (schedule vs. manual
+    # dispatch); --if-changed already makes a second ping a cheap no-op, but
+    # queueing avoids two SSH sessions racing on the host regardless.
+    concurrency:
+      group: ops-indexnow
+      cancel-in-progress: false
     steps:
       - name: Ping IndexNow if the URL set changed
         uses: https://github.com/appleboy/ssh-action@v1.2.0