CI/CD improvements

[jflo]

The following gaps have been identified and need to be addressed:

1. Deferred tests do not prevent merging into main, as expected. Since an action run that is skipped by a conditional is considered "successful", the approval checking steps in our workflows are actually passing the check before the test has run. Suggest simply running all tests on PR update, as CircleCI did and refactoring later to re-implement deferral.
2. Subsequent updates to a branch with a PR do not cancel any in-flight executions.
3. A constantly built artifact is needed for nightly updates to automated canaries.
4. CodeQL workflow is very expensive, it can be run nightly on main or manually.