[github] Fix agentic workflows based on gh-aw guide

[rolfbjarne]

I asked Copilot to review our agentic workflows according to https://github.com/dotnet/vitals/blob/main/.agents/skills/gh-aw-guide/SKILL.md,
and this is what it came up with:

• Fix 'maintainer' → 'maintain' (correct GitHub role name)
• Change min-integrity from 'none' to 'approved' for both workflows (safer default
  for public repos, prevents XPIA from untrusted content)
• Add concurrency groups (cancel-in-progress: false for slash_command, true for
  schedule/dispatch)
• Add supersede-older-reviews: true on reviewer (auto-dismiss stale REQUEST_CHANGES
  reviews)
• Use fuzzy schedule 'daily' instead of fixed cron for code-radiator
• Add target: "*" on add-comment/add-labels for code-radiator (no triggering PR
  context on schedule/dispatch)
• Recompile lock files

[Copilot]

Pull request overview

Updates the repository’s GitHub Agentic Workflows (gh-aw) configurations for the PR reviewer and Code Radiator automation to align with the referenced gh-aw guide, tightening security defaults and improving run behavior.

Changes:

• Corrects the GitHub permission role name from maintainer to maintain.
• Tightens GitHub tool integrity filtering (min-integrity: approved) and adjusts safe-outputs behavior (including auto-superseding stale “REQUEST_CHANGES” reviews for the reviewer workflow).
• Adds concurrency controls and updates Code Radiator scheduling to a “daily (scattered)” schedule; recompiles the generated lock workflows accordingly.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/macios-reviewer.md	Updates gh-aw frontmatter: role name fix, adds concurrency, switches min-integrity to approved, and enables superseding older reviews.
.github/workflows/macios-reviewer.lock.yml	Recompiled lock workflow reflecting the updated reviewer frontmatter settings (integrity filter, concurrency, supersede behavior, roles).
.github/workflows/code-radiator.md	Updates gh-aw frontmatter: daily schedule, role name fix, adds concurrency, switches min-integrity to approved, and sets wildcard targets for comment/label safe-outputs.
.github/workflows/code-radiator.lock.yml	Recompiled lock workflow reflecting the updated Code Radiator frontmatter settings (schedule, integrity filter, concurrency, safe-outputs targets, roles).