Migrate mql workflows to arc runners and add PR concurrency

[username-is-already-taken2]

Summary

This updates the mql workflows to continue the runner migration away from the old Default pool and adds concurrency protection to a few PR-oriented workflows that were missing it.

Changes

• move goreleaser.yml from group: Default to group: arc-runners
• move pr-test-generated-files.yaml from group: Default to group: arc-runners
• move the go-test and go-test-integration jobs in pr-test-lint.yml from group: Default to group: arc-runners
• add concurrency to:
  • pr-test-windows.yml
  • spell-check.yaml
  • xgrep.yaml

Notes

• existing ubuntu-latest jobs were left unchanged
• actions/setup-go cache settings were already cache: false where relevant
• cla.yaml was intentionally left untouched for now because it uses pull_request_target / issue_comment and should be handled separately

[mondoo-code-review]

Straightforward migration from Default to arc-runners and addition of PR concurrency groups — looks good.

[mondoo-code-review]

Straightforward runner migration and concurrency additions; one minor gap in concurrency config.

[mondoo-code-review]

🔵 suggestion — The other PR-triggered workflows (pr-test-windows, spell-check, xgrep) all gained a concurrency block, but this workflow (pr-test-lint) did not. Since it has two long-running jobs (go-test and go-test-integration, both with 120-minute timeouts), it would benefit the most from cancel-in-progress. Consider adding:

concurrency:
  group: pr-test-lint-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

[mondoo-code-review]

🔵 suggestion — Same note: this workflow was migrated to arc-runners but no concurrency block was added, unlike the other PR workflows. Consider adding one for consistency and to avoid redundant runs.

[mondoo-code-review]

🔵 suggestion — The rpm package is installed unconditionally every run. If the ARC runner image is under your control, consider baking rpm into the base image to save CI time. If not, this is fine as-is.