Serialize rolling publisher so older pushes cannot overwrite newer candidates

[mark-e-deyoung]

Problem

The rolling semper-exp-current publisher is triggered by pushes to semper/compile-observer, but the compile/publish workflow currently has no workflow-level concurrency policy.

Two pushes can therefore build and publish concurrently:

1. push A starts a slower build;
2. newer push B starts and finishes first, moving semper-exp-current to B;
3. A finishes later and moves the same mutable tag/release back to the older A candidate.

Because the publisher also replaces release assets, overlapping publishers can expose a transient or final channel state whose tag/assets reflect the wrong push order. The source-snapshot workflow has its own concurrency group, but that does not serialize the primary publisher.

Required behavior

The rolling channel must be monotonic with respect to the candidate branch: an older in-flight workflow must never overwrite a newer candidate.

Use the smallest robust mechanism, for example a branch-scoped concurrency group with cancellation of superseded runs, plus a fail-closed check immediately before release mutation that the candidate being published is still the current semper/compile-observer branch head.

The branch-head check matters even with cancellation because cancellation is cooperative and a write-capable job may already be running.

Acceptance

• Push A followed by push B cannot leave semper-exp-current at A after B exists.
• A superseded publisher cannot move the tag or replace release assets after B becomes branch head.
• The manifest source.commit, rolling tag target, release assets, and downstream source snapshot all remain tied to one candidate SHA.
• PR build/test runs remain unaffected and non-publishing.
• Manual workflow dispatch does not gain release mutation authority.
• No engine-semantic changes are involved.

Relationship to #2

#2 removes release mutation from pull-request execution. This issue handles ordering/race safety after release authority is narrowed to branch pushes. Both should be resolved before the rolling channel is treated as a hardened promotion surface.