Address review feedback on docs-preview workflows

- Disable the uv Actions cache in the build job: pull_request_target runs
  share the base-branch cache scope, so a cache populated while untrusted
  PR code ran could poison later trusted workflows. Mirrors the posture in
  publish-pypi.yml.
- Fix concurrency: workflow-level concurrency is evaluated before job
  if-conditions, so any PR comment was cancelling in-flight previews. Only
  runs that actually produce a preview now share a group; unrelated comment
  runs fall through to a unique run_id group.
- Replace .github/zizmor.yml with inline ignore comments anchored to the
  pull_request_target lines (matching the existing pattern in claude.yml).
- Raise the cleanup pagination cap to 200 pages.

:house: Remote-Dev: homespace

Author: localden

.github/workflows/docs-preview-cleanup.yml

@@ -5,7 +5,7 @@ name: Docs Preview Cleanup
 # checks out PR code, so there is no untrusted-code execution risk.
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] never checks out PR code
     types: [closed]
 
 permissions: {}
@@ -30,7 +30,7 @@ jobs:
           # Collect matching ids across all pages first, then delete — deleting
           # mid-pagination would shift later pages and skip entries.
           ids=""
-          for page in $(seq 1 50); do
+          for page in $(seq 1 200); do
             resp=$(curl -fsS -H "Authorization: Bearer $CF_API_TOKEN" "$base?env=preview&per_page=25&page=$page")
             ids="$ids $(jq -r --arg b "$BRANCH" '.result[]? | select(.deployment_trigger.metadata.branch == $b) | .id' <<<"$resp")"
             [ "$(jq '.result | length' <<<"$resp")" -lt 25 ] && break

.github/workflows/docs-preview.yml

@@ -15,7 +15,7 @@ name: Docs Preview
 #   - vars.CLOUDFLARE_PAGES_PROJECT  (existing Pages project, e.g. mcp-python-sdk-docs)
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] build is permission-gated and secret-isolated; see header comment
     types: [opened, reopened, synchronize]
     paths:
       - docs/**
@@ -28,7 +28,16 @@ on:
 permissions: {}
 
 concurrency:
-  group: docs-preview-pr-${{ github.event.pull_request.number || github.event.issue.number }}
+  # Workflow-level concurrency is evaluated when the run is queued — before any
+  # job-level `if:` — so an unrelated PR comment would otherwise cancel an
+  # in-flight build. Only runs that actually produce a preview share a group;
+  # everything else falls through to a unique run_id group.
+  group: >-
+    docs-preview-pr-${{
+      github.event_name == 'pull_request_target' && github.event.pull_request.number
+      || (github.event.issue.pull_request && startsWith(github.event.comment.body, '/preview-docs') && github.event.issue.number)
+      || github.run_id
+    }}
   cancel-in-progress: true
 
 jobs:
@@ -113,7 +122,10 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          enable-cache: true
+          # pull_request_target runs share the base-branch Actions cache; saving
+          # a cache populated while untrusted PR code ran would let it poison
+          # later trusted workflows. Mirrors publish-pypi.yml.
+          enable-cache: false
           version: 0.9.5
 
       - run: uv sync --frozen --group docs