Harden the Integration workflow

### Description

Improve the existing Integration workflow’s efficiency, security, and merge-gate reliability while retaining one required repository-verification job. The workflow should cancel obsolete pull-request runs, use least-privilege access, cache the pnpm store, provide clear verification stages, and be correctly required for protected branches.

### Action Items

- [ ] Review the current Integration workflow, runtime setup, and verification command.
- [ ] Add workflow-level concurrency keyed by pull request, cancelling superseded PR runs without cancelling main or stable push runs.
- [ ] Set explicit least-privilege permissions for the workflow.
- [ ] Cache the pnpm store using a lockfile-based key after mise has configured pnpm.
- [ ] Retain one required verification job and one dependency install per run.
- [ ] Make verification stages clear in the workflow UI: static checks/unit tests, application build, and container build.
- [ ] Keep the workflow and job check names stable and document the required status-check names.
- [ ] Configure or verify branch protection requires the Integration check and Compliance check for main and stable.
- [ ] Verify normal PR, superseded PR, and main/stable push behavior.

### Additional Information

Do not split the workflow into multiple jobs unless measured run times show that it is necessary. The expected first candidate for a future split is container builds, not the core repository verification job.

Related work: #732 establishes meaningful unit-test coverage; Integration already invokes the repository test command through pnpm verification.