Overview

The required checks weren't being run when a PR originated in a contributor fork (e.g. #6155 cc @stew)

side fixes:

• add concurrency groups to a couple of workflows so they're not churning on out-of-date work
• fix check scripts to pass flags through

Implementation approach and notes

Switch verify-proofs from on push to pull_request, but set the ref to the push ref and not the default merge ref.

Interesting/controversial decisions

Loose ends

I thought about splitting ci.yaml into a separate file for PRs vs merge-queue checks.

Test coverage

Hard to test CI before its merged :(