ci: reduce macOS runner queue pressure

[beruro]

Problem

Both pull-request validation jobs run on macos-latest, so each CI run consumes two of the organization’s five concurrent macOS slots. Bursty branch updates create a long queue, and without PR-scoped cancellation, superseded commits continue waiting or running after a newer commit exists.

Solution

Add PR-scoped workflow concurrency with cancel-in-progress: true, so a new push replaces the older CI run for that PR. Move the platform-independent Frontend typecheck, lint, and Vitest job to ubuntu-latest, while retaining Rust clippy on macOS for platform coverage. Scope the node_modules cache key by runner OS.

The resulting invariant is: each PR has at most one current CI run, and each run consumes at most one macOS runner slot.

Potential risks

The Frontend job now executes on Linux, so an unintentionally OS-dependent frontend test could behave differently. The suite models Windows and macOS paths as explicit inputs rather than relying on the host platform, and the unchanged Rust job retains macOS execution. The first Ubuntu run reproduced four failures that also reproduce identically on local macOS at the same SHA; those existing develop failures are fixed separately by #753. Rollback is a single revert of this commit.

Verification

• git diff --check — passed.
• Ruby YAML parse of .github/workflows/ci.yml — passed.
• Prettier check of .github/workflows/ci.yml — passed.
• Repository pre-commit hook — passed; no TypeScript or Rust files changed.
• Cancelled 20 obsolete CI runs across two SHA reconciliation passes; each was superseded or no longer belonged to an open PR, and all 20 reached completed/cancelled.
• GitHub-hosted Frontend job acquired an Ubuntu runner in 4 seconds; dependency installation, typecheck, and lint passed.
• Full Ubuntu Vitest run completed 1,020/1,022 files and 8,262/8,266 tests, with four synchronous SSR failures in two files.
• Re-ran those two files on local macOS at the same SHA — reproduced the identical 4 failures / 5 passes, confirming they are not caused by the Ubuntu migration.
• test(markdown): stabilize issue SSR mocks #753 fixes those existing develop SSR test-boundary failures in a separate single-responsibility PR.
• Rust clippy on the retained macOS runner — passed in 15m18s.
• Check AI attribution — passed in 12s.