ci: correlate codegen validation runs

[ryanduguid]

Summary

• ask the workflow-dispatch API to return the exact codegen run it created
• wait for that run ID instead of selecting the repository's latest run after a fixed sleep
• remove the unused checkout and broad write permissions
• pin the GitHub App token action and replace the extra third-party wait action with GitHub CLI
• cancel superseded validation for the same pull request and bound total runtime

Why

Concurrent pull requests can currently select each other's codegen runs, which can report the wrong validation result. GitHub's dispatch API now returns the created run ID when return_run_details is enabled.

Validation

• actionlint .github/workflows/pr-validation.yml
• git diff --check

The private codegen repository and its application credentials are intentionally not accessible to this contribution. Maintainers should confirm one real dispatch in the trusted upstream environment before taking this pull request out of draft.