ci: reduce duplicate runs and runner contention #28

Problem

Feature commits start the full CI on both push and pull_request, duplicating
Linux, macOS, Windows and documentation runs. Older PR revisions keep consuming
runner slots after a newer head is available. Independent CodeQL jobs further
increase simultaneous demand.

Deliverable

• Run CI for pull requests and pushes to main, without duplicate feature pushes.
• Supersede old CI and CodeQL runs for the same PR using separate concurrency groups.
• Move the existing documentation link check to the start of the Linux contract job.
• Preserve all three CodeQL analyses and their categories/check names while
  limiting the language matrix to one concurrent job.
• Keep native macOS/Windows qualification, the complete Linux suite and all
  assertions. Do not serialize the two Dependabot authority contexts together.
• Pin workflow Actions by immutable commit while continuing to install the
  unversioned Rust stable channel. Keep checkout credentials out of subsequent
  build and documentation steps, which do not need repository write access.

Acceptance

• Workflow validation passes and the changed event configuration runs on this PR.
• One normal PR revision starts three CI jobs and three sequential CodeQL jobs,
  rather than duplicate CI runs plus parallel scans.
• Documentation failure fails the required Linux contract job before expensive setup.
• CI for a new PR head supersedes obsolete revisions without cancelling other PRs.
• Required-check migration preserves documentation coverage when the separate
  Documentation job is retired, without fabricated check results.

This change follows the workflow setup delivered by #27.