Set contents: read permissions on every workflow and add per-workflow
concurrency groups keyed on the git ref to deduplicate concurrent runs.
Release workflow keeps cancel-in-progress: false so a release build is
never canceled; job-level contents: write on attach-to-release is
preserved. Concurrency groups use hardcoded prefixes so reusable
workflows called from release.yml do not inherit the caller workflow
name and collide.
Build the CLI tools in a dedicated ubuntu:24.04 workflow and pack them
with the AppImage into a single linux-<version>.zip, matching the
Windows/macOS release shape.
