ci: serialize root integration packages

[xxvcc]

Summary

• serialize root integration packages with -p 1 in ordinary and release CI because they share /etc/passwd and shadow state
• add a regression assertion for both workflows
• prepare v2.8.2 release documentation and record the existing ed25519 key custody risk accurately

Failure evidence

Release run 30265661266 ran internal/cli and internal/user concurrently. internal/user.TestUserLifecycle timed out in useradd after 120 seconds while the CLI package was also mutating the account databases. No build artifact, draft, or Release was created.

Verification

• fresh privileged golang:1.26.5-bookworm container: go test -mod=readonly -count=1 -race -p 1 -tags integration ./...
• go test -mod=readonly -count=1 -race ./...
• go vet -printf.funcs=printf,errorf,warnf ./...
• amd64 and arm64 static release builds
• ShellCheck and actionlint 1.7.12
• zizmor 1.28.0 online audit
• govulncheck 1.6.0
• mirror receiver policy tests and syntax/format checks