ci(release): move the v1 tag onto the image pin commit

The release job moves the rolling v1 tag to the release commit. The
update-action-version job then pins action.yml to the new image in a
later commit. So v1 always pointed at a commit that pinned the
previous image, and "@v1" users ran the previous release.

The job now checks out the released commit, pushes the pin commit with
"git push origin HEAD:main", and moves v1 onto it after that push
succeeds. If main moved during the release, the push fails and v1
stays where it is. The job runs only for main, and a concurrency group
queues overlapping release runs.

Claude-Session: https://claude.ai/code/session_01Qq1gbqQek1Zjtofo4VDRdW

.github/workflows/release.yaml

@@ -14,6 +14,10 @@ permissions:
   contents: write
   packages: write
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
@@ -27,11 +31,11 @@ jobs:
   update-action-version:
     needs: release
     runs-on: ubuntu-latest
-    if: needs.release.outputs.version != ''
+    if: github.ref == 'refs/heads/main' && needs.release.outputs.version != ''
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: main
+          ref: ${{ github.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Update action.yml with release version
@@ -52,5 +56,17 @@ jobs:
             echo "No changes to commit"
           else
             git commit -m "chore: pin action.yml Docker image to v${{ needs.release.outputs.version }}"
-            git push
+            # Push the pin commit onto main explicitly (not just "git push"):
+            # this checkout started from the released commit (github.sha), not
+            # main's tip, so if main moved in the meantime this push is a
+            # non-fast-forward and fails safely instead of overwriting it.
+            git push origin HEAD:main
+            # Only move the rolling tag once the pin commit is confirmed on
+            # main. The "release" job above already moved it to the release
+            # commit, but this job then commits action.yml's image pin on top
+            # of that, so without this the rolling tag would always be one
+            # commit behind, pinning the PREVIOUS image.
+            # "v1" must match the release job's rolling-release-tag input.
+            git tag -f v1 HEAD
+            git push -f origin refs/tags/v1
           fi