[L01] Static workflow conformance

[yunseo-kim]

Scope

Complete internal/workflowcheck/ for hosted runners, hardening, SHA pins, permissions, graph, mutation ownership, concurrency, and self-cancellation traps.

Contracts

ADRs 0002, 0036, 0053, 0058, 0066, 0074, 0075

Dependencies

X03

Blocking issues: [X03] #38.

Executable QA

`go test ./internal/workflowcheck -run '^TestProductionWorkflowConformance$' -count=1 -v` must exit 0 for all three production workflows. `go run ./cmd/slsa-builder-internal workflow-check --all .github/workflows` must exit 0. A fixture containing `github.workflow` in a concurrency key must exit 1 with its static conformance diagnostic.