ci: limit publish workflow to single concurrent run

Cancel any in-progress publish when a new push to staged arrives,
ensuring only the latest version is published to main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/publish.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [staged]
 
+concurrency:
+  group: publish-to-main
+  cancel-in-progress: true
+
 permissions:
   contents: write