CI: verify MoltenVK download, cancel superseded runs, fix deprecated set-output

- Verify the SHA-256 of the downloaded MoltenVK tarball before extracting it (macOS jobs).

- Add concurrency cancellation so superseded PR/push builds stop instead of running the full matrix to completion.

- Replace the removed ::set-output workflow command with $GITHUB_OUTPUT in the release version calculation.

.github/workflows/build.yml

@@ -239,6 +239,7 @@ jobs:
     - name: "Install molten-vk"
       run: |
         curl -L -O https://github.com/KhronosGroup/MoltenVK/releases/download/v1.4.1/MoltenVK-macos-privateapi.tar
+        echo "5e662d77f7f280d9bd692ac5d626831198f404e28b0c8d4d11aac04bff8ff418  MoltenVK-macos-privateapi.tar" | shasum -a 256 -c -
         tar xf MoltenVK-macos-privateapi.tar
         sudo mkdir -p /usr/local/lib
         sudo cp MoltenVK/MoltenVK/dynamic/dylib/macOS/libMoltenVK.dylib /usr/local/lib

.github/workflows/build_check.yml

@@ -13,6 +13,11 @@ on:
     branches:
       - main
 
+# Cancel superseded runs for the same ref to save CI minutes
+concurrency:
+  group: build-check-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     uses: ./.github/workflows/build.yml

.github/workflows/determine_release_version.yml

@@ -45,8 +45,7 @@ jobs:
             exit 1
           fi
 
-          echo "::set-output name=tag::$ALL_TAGS"
-          # echo "tag=$ALL_TAGS" >> $GITHUB_STATE
+          echo "tag=$ALL_TAGS" >> "$GITHUB_OUTPUT"
 
       - name: Calculate next semver minor
         id: calculate_next_version