ci: dedupe concurrent push/PR runs to stop Harbor push race

The push and pull_request triggers spawned two concurrent runs for the
same commit, racing on the Harbor image push (build-docker failing with
'blob upload invalid'). Add a concurrency group keyed on the head commit
SHA (shared by both events) with cancel-in-progress, so only one run per
commit executes.

https://claude.ai/code/session_01S76fk9ma5Szkf9r1W44RVP

Author: claude

.github/workflows/ci.yml

@@ -15,6 +15,10 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
+concurrency:
+  group: ci-${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   build-gradle:
     runs-on: ubuntu-latest