ci(demo-deploy): tighten permissions and add concurrency control

Replace broad contents: write with least-privilege permissions
(contents: read, pages: write, id-token: write). Add concurrency
group to cancel in-progress deployments on new pushes.

Author: orrisroot

.github/workflows/demo-deploy.yml

@@ -6,7 +6,13 @@ on:
       - 'v*'
 
 permissions:
-  contents: write
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
 
 jobs:
   build: