chore: pin shared ci refs and run pre-push validation stage

[N4M3Z]

Problem

quality.yaml and release.yaml reference setup-forge and module-release.yaml at @main, so any push to forge-cli changes CI behavior for every module and no run is reproducible. CI also runs only the commit-stage prek hooks, so pre-push-stage gates never execute here (forge-text already runs both stages). Superseded runs on the same ref keep executing to completion.

Fix

Pin both forge-cli refs to v0.3.2 (identical content to main today, verified by diff). Run the pre-push prek stage after the commit stage so CI matches make validate. Add a concurrency group that cancels superseded runs.

Test plan

• Quality workflow green on this PR with both validation stages
• module-release.yaml and setup-forge/action.yml diffed empty between v0.3.2 and origin/main