chore(ci): gate production deploys on tested commits

[yzua]

Summary

• add lint, build, and functional Playwright validation on pull requests and pushes
• deploy main only after the exact pushed commit passes validation
• replace direct push-triggered deployment with the existing GitHub OIDC deployer gate
• SHA-pin third-party actions and bound workflow concurrency/timeouts

Safety

The same workflow already passed and deployed successfully on testing: https://github.com/quran/next-open-graph/actions/runs/32712961225

Production remains GitHub-hosted because this is a public repository; untrusted pull-request code must not run on QF self-hosted runners.