On 10-05 and 10-06 nearly every Test run on main was cancelled by the next push, so a release had no finished run to wait for and Linux-only failures shipped (LESSONS.md: "Don't tag until a CI Test run ... has finished green"). cancel-in-progress is now false on main only: a running run completes, and GitHub still replaces a queued one with the newest. PRs keep cancelling their older runs. The workflow had no permissions block, so it got the repository default token; it needs only to read.