[User Story] Add concurrency group to PR plan workflow to prevent orphaned waiting runs

[noahwhite]

Story Summary

As a platform engineer, I want the PR OpenTofu Plan workflow to cancel superseded runs automatically, so that merged or re-pushed PRs don't leave orphaned runs stuck in the dev-ci waiting state indefinitely.

---

✅ Acceptance Criteria

• pr-tofu-plan-develop.yml has a concurrency group keyed on PR number with cancel-in-progress: true
• When a new commit is pushed to an open PR, the previous waiting plan run is cancelled automatically
• No orphaned waiting runs accumulate after PRs are merged or re-pushed

---

📝 Additional Context

• pr-tofu-plan-develop.yml uses the dev-ci environment (required reviewer), so each run enters a "waiting" state until approved. When a PR merges before approval, the run is never dismissed and sits in waiting state until GitHub's 30-day timeout.
• Fix: add concurrency: { group: tofu-plan-${{ github.event.pull_request.number }}, cancel-in-progress: true } at the job or workflow level.
• Existing orphaned runs cannot be cancelled via API with current token permissions — they will time out naturally.

---

📦 Definition of Ready

• Acceptance criteria defined
• No unresolved external dependencies
• Story is estimated
• Team has necessary skills and access
• Priority is clear
• Business value understood

---

✅ Definition of Done

• All acceptance criteria met
• Unit/integration tests written & passing
• Peer-reviewed
• Docs updated (if applicable)
• Verified in staging (if needed)
• No critical bugs/regressions

[linear]

GHO-122