deps: update concurrent-ruby for dependabot alerts

[unattributed]

Summary

• Updates concurrent-ruby from 1.3.6 to 1.3.7 in Gemfile.lock.
• Addresses the open Dependabot alerts for CVE-2026-54904, CVE-2026-54905, and CVE-2026-54906, all of which affect concurrent-ruby versions prior to 1.3.7.
• Adds pull request validation for the Jekyll Pages workflow while keeping deployment restricted to pushes to main.

Validation

• GitHub Actions should run the Jekyll build on this pull request.
• After merge, Dependabot should close the three open alerts once the dependency graph refreshes.

Security

• No runtime site behavior changes.
• No JavaScript or frontend dependency additions.
• Dependency lockfile update only, plus CI validation coverage.