.github/workflows/test.yml hardening (all verified against the current file).

• No permissions: block (test.yml:3-7) — inherits the default token scope; the other three workflows scope correctly. Add permissions: { contents: read }.
• Duplicate runs — triggers on push to ** and pull_request to main, so every push to an open same-repo PR runs CI twice. Scope push to main.
• No concurrency cancellation — stale runs pile up. Add a concurrency group keyed on ref with cancel-in-progress.
• No -race/-cover — -race passes locally in ~3s, so it's free.

on:
  push:
    branches: [main]
  pull_request:
permissions:
  contents: read
concurrency:
  group: test-${{ github.ref }}
  cancel-in-progress: true
# test step:
        run: go test -race -cover $(go list ./... | grep -v /integration)

(After the integration build-tag fix, the grep -v can drop.) Effort: S.