chore(ci): scope the workflow token and cancel superseded runs

[LKSNDRTMLKV]

P4/P6 of the check-coverage audit, applied here. Small and mechanical.

Found by tools/check-ci-parity.sh — a cross-repo drift report added in the
docs repo after a single audit turned up four separate cases of a fix being made
in one repository and never reaching its sibling.

This repo came back green on almost everything: actions all SHA-pinned, one CI
run per change, Cargo.lock committed, deny.toml present. It is the
reference the others were brought up to. Two gaps remained.

permissions: on ci.yml and fuzz.yml

Neither had a block, so every job inherited the repository default token scope.
Both only read the tree, build and test — nothing writes. release.yml is left
exactly as it is: it publishes images and correctly declares
packages: write, which is the point of having the block rather than a blanket
rule.

concurrency on ci.yml

A rebase or a follow-up push left the superseded run going to completion. Now
cancelled — except on main, deliberately: the post-merge run is the record for
that commit, and cancelling it would leave a merged commit never fully built.

Verification

All four workflow files parse and now carry a permissions block. No job logic,
no dependency and no build step touched, so CI on this PR is the check.