genie githubWorkflow: support concurrency.queue single|max

Context

GitHub Actions now supports concurrency.queue at workflow and job scope. queue: single preserves the default one-pending-run replacement behavior; queue: max retains up to 100 pending runs in the concurrency group. GitHub rejects queue: max together with cancel-in-progress: true.

Official documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrency

@overeng/genie cannot currently express this documented field. Its shared Concurrency type contains only group and cancel-in-progress, and is used by both GitHubWorkflowArgs.concurrency and Job.concurrency:

• https://github.com/overengineeringstudio/effect-utils/blob/348be5df590265d02d6a5bc11b5b4990b8f0157e/packages/%40overeng/genie/src/runtime/github-workflow/mod.ts#L241-L244
• https://github.com/overengineeringstudio/effect-utils/blob/348be5df590265d02d6a5bc11b5b4990b8f0157e/packages/%40overeng/genie/src/runtime/github-workflow/mod.ts#L246-L254
• https://github.com/overengineeringstudio/effect-utils/blob/348be5df590265d02d6a5bc11b5b4990b8f0157e/packages/%40overeng/genie/src/runtime/github-workflow/mod.ts#L265-L280

Proposed API

Extend the existing shared type with the exact documented literal union:

type Concurrency = {
  group: string
  'cancel-in-progress'?: boolean | Expression
  queue?: 'single' | 'max'
}

This keeps workflow- and job-level behavior aligned and rejects misspelled or speculative queue modes at compile time. Do not add a raw-string escape hatch.

Safety semantics

• Preserve omission as the GitHub default (single); do not emit queue unless requested.
• Serialize single and max unchanged.
• Fail closed for the statically invalid literal combination queue: 'max' plus cancel-in-progress: true, either through the existing actionlint validation path or a focused built-in validator if the pinned actionlint does not yet recognize the new syntax.
• Do not reject cancel-in-progress expressions unless their incompatibility can be proven statically.

Acceptance criteria

• GitHubWorkflowArgs.concurrency accepts queue: 'single' | 'max' and rejects other literals.
• Job-level concurrency receives the same support through the shared type.
• Unit tests assert exact generated YAML for queue: single, queue: max, and omission.
• An actionlint integration test proves a generated workflow using supported queue: max passes validation.
• A validation test proves literal queue: max plus cancel-in-progress: true fails with an actionable diagnostic.
• Existing concurrency generation remains byte-stable when queue is omitted.
• dt test:genie, dt genie:check, and the repository's TypeScript checks pass.

Downstream need

schickling/schickling-stiftung#216 adds event-driven deployment-status reconciliation. Several authoritative workflow completions can arrive while one reconciliation is running. GitHub's default single policy replaces an already-pending run, which can discard an intermediate reconciliation trigger. queue: max lets these trusted triggers serialize instead; each run then applies and read-after-write verifies the Notion projection without concurrent writers or silent pending-run replacement.

This should be implemented once in Genie's typed GitHub workflow model rather than bypassing the generator or patching generated YAML downstream.

Start in packages/@overeng/genie/src/runtime/github-workflow/mod.ts and trace the shared Concurrency type through GitHubWorkflowArgs.concurrency and Job.concurrency. Read the existing generation, validation, and test paths, then cover queue omission and both literal values, actionlint validation, the invalid max/cancel-in-progress combination, and the listed dt test and check commands.