fix(ci): serialize release and deploy chain

.gitea/workflows/deploy-prod.yml

@@ -12,7 +12,7 @@ on:
         type: string
 
 concurrency:
-  group: deploy-prod-main
+  group: deploy-prod-${{ github.event.workflow_run.head_sha || github.sha }}
   cancel-in-progress: false
 
 env:
@@ -92,6 +92,25 @@ jobs:
           echo "✓ Artifact: $ARTIFACT"
           echo "✓ Download URL: $DOWNLOAD_URL"
 
+      - name: Validate Release Chain
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            EXPECTED_SHA="${{ github.event.workflow_run.head_sha }}"
+            RELEASE_TAG="${{ steps.fetch.outputs.tag }}"
+            RELEASE_SHA="${RELEASE_TAG##*.}"
+
+            if [ "$EXPECTED_SHA" != "$RELEASE_SHA" ]; then
+              echo "ERROR: Release SHA does not match upstream workflow SHA"
+              echo "Expected: $EXPECTED_SHA"
+              echo "Release:  $RELEASE_SHA"
+              exit 1
+            fi
+
+            echo "✓ Release chain verified: $EXPECTED_SHA"
+          else
+            echo "✓ Workflow dispatch mode — release chain verification skipped"
+          fi
+
       - name: Download Release Artifact
         run: |
           ARTIFACT="${{ steps.fetch.outputs.artifact }}"

.gitea/workflows/prepare-release.yml

@@ -14,6 +14,10 @@ on:
 env:
   DOTNET_VERSION: '10.0.x'
 
+concurrency:
+  group: prepare-release-${{ github.event.workflow_run.head_sha || github.sha }}
+  cancel-in-progress: false
+
 jobs:
   build-and-release:
     name: Build & Create Release