fix(ci): isolate ineligible PR walkthrough triggers (#3862)

.github/workflows/pr-walkthrough.yml

@@ -16,7 +16,39 @@ env:
   PR_WALKTHROUGH_VARIANT: high
 
 concurrency:
-  group: pr-walkthrough-${{ github.event.pull_request.number }}
+  # GitHub resolves workflow concurrency before it evaluates the job `if`.
+  # Keep every event rejected by the generation gate out of the canceling
+  # group so it cannot terminate an eligible run for the same pull request.
+  group: >-
+    pr-walkthrough-${{ github.event.pull_request.number }}${{
+      (
+        vars.PR_WALKTHROUGH_ENABLED != 'true' ||
+        github.event_name != 'pull_request_target' ||
+        github.event.pull_request.draft != false ||
+        !(
+          (
+            github.event.pull_request.head.repo.full_name == github.repository &&
+            (github.event.action == 'opened' ||
+             github.event.action == 'reopened' ||
+             github.event.action == 'ready_for_review' ||
+             github.event.action == 'synchronize' ||
+             (github.event.action == 'labeled' && github.event.label.name == 'generate-pr-walkthrough'))
+          ) ||
+          (
+            github.event.pull_request.head.repo.full_name != github.repository &&
+            (
+              (github.event.action == 'labeled' && github.event.label.name == 'safe-to-review') ||
+              (github.event.action != 'labeled' &&
+               (
+                 contains(github.event.pull_request.labels.*.name, 'safe-to-review') ||
+                 (vars.CLAUDE_REVIEW_ALLOWLIST != '' &&
+                  contains(fromJSON(vars.CLAUDE_REVIEW_ALLOWLIST), github.event.pull_request.user.login))
+               ))
+            )
+          )
+        )
+      ) && '-ineligible' || ''
+    }}
   cancel-in-progress: true
 
 jobs: