improve claude workflows clarity and security

[shashial]

📝 Summary

• Apply least-privilege permissions — moved permissions from workflow-level to per-job.
• Prevent double-trigger on @claude review — claude-response now excludes @claude review comments on the issue_comment path, so only claude-manual-review handles those.
• Add concurrency groups — each job cancels stale in-progress runs per PR, preventing redundant parallel executions on rapid pushes.
• Add security prompt to interactive mode.