CI hardening: reject superseded rolling publishers

[mark-e-deyoung]

Purpose

Prevent an older in-flight push from overwriting a newer semper-exp-current candidate after publication authority is narrowed to branch pushes.

Implements #3 as a separate stacked change on top of #5.

Change

• serialize the write-capable publish-experimental job with a dedicated concurrency group and cancellation of superseded publisher jobs;
• immediately before tag/release mutation, resolve the current semper/compile-observer branch head and fail closed unless it still equals this workflow's candidate SHA.

Why both controls

Concurrency reduces overlapping write-capable publishers, but cancellation is cooperative. The branch-head check prevents a slower older build from publishing after a newer branch head already exists even if that older workflow reaches the publisher later.

Stack / rollout

This PR targets hardening/push-only-experimental-publisher so its diff remains independent from #5. Neither branch is the release-triggering semper/compile-observer branch.

Do not retarget/merge into the release branch until #5 and the private promotion state are ready.

Closes #3 when the stacked change ultimately lands on semper/compile-observer.