Add concurrency control and least-privilege permissions to PR check workflow

Summary

The pr-check.yml workflow is missing a concurrency group and explicit permissions,
unlike its sibling precommit-check.yml which already has both.

Proposed Changes

1. Add concurrency group — cancel in-progress runs when a new push arrives on the
   same PR, preventing wasted CI runner minutes on stale runs.
2. Add explicit permissions block — declare least-privilege read access for
   pull-requests and contents, following GitHub's security hardening recommendations.
3. Bump Python from 3.10 to 3.12 — consistent with precommit-check.yml and uses
   a more current runtime.

Motivation

• Rapid successive pushes to a PR currently trigger multiple redundant workflow runs.
• Without explicit permissions, the workflow inherits the repository-wide default, which
  is broader than necessary.
• Python version inconsistency across workflows in the same directory.

All three patterns already exist in precommit-check.yml, so this aligns pr-check.yml
with established conventions.

Start by comparing pr-check.yml with its sibling precommit-check.yml, focusing on the existing concurrency, permissions, and Python setup patterns. Update pr-check.yml to match the three requested conventions, then run or inspect the PR check workflow configuration to confirm the concurrency group, read-only permissions, and Python 3.12 setting are present.