ci(pr-checks): switch to mise toolchain and prek hooks

Refine pull_request triggers to opened, reopened, synchronize, ready_for_review. Add concurrency group to cancel in-progress runs. Set contents:read permissions
Replace setup-python/pre-commit action with mise-action and prek run

Author: tmeckel

.github/workflows/pr-checks.yml

@@ -2,7 +2,19 @@
 name: Pull Request validation
 
 on:
-  - pull_request
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+concurrency:
+  group: pr-validation-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 jobs:
   pre-commit:
@@ -12,13 +24,11 @@ jobs:
         id: checkout
         uses: actions/checkout@v5
 
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v5
+      - name: Setup toolchain with mise
+        uses: jdx/mise-action@v2
 
-      - name: Run pre-commit checks
-        id: pre-commit
-        uses: cloudposse/github-action-pre-commit@v4.0.0
+      - name: Run prek hooks
+        run: prek run --all-files --show-diff-on-failure --color=always
 
       - name: Build Docker image if Dockerfile changed
         run: |