fix: push can't cancel preview teardown (reliable cleanup)

[nourshoreibah]

Bug

Remove the test-environment label, then immediately push a commit → the preview stack leaks (never torn down).

Why

preview-env.yml used one workflow-wide concurrency group with cancel-in-progress: true:

1. Unlabel → teardown run starts.
2. Push → new run in the same group → cancels the in-flight teardown.
3. That push run's deploy job is skipped (label already gone) and its teardown job doesn't match synchronize → both jobs skip.
4. Teardown was cancelled and nothing re-runs it → resources leak.

Fix

Per-job concurrency instead of workflow-wide:

• deploy → preview-deploy-<pr>, cancel-in-progress: true (back-to-back commits still cancel the older deploy).
• teardown → preview-teardown-<pr>, cancel-in-progress: false (a teardown is never cancelled; repeated teardowns queue and no-op on the already-deleted workspace).

Any overlapping terraform is serialized by the existing DynamoDB state lock, so cleanup is correct for every event ordering:

• unlabel-then-push → push's deploy is skipped, teardown runs to completion ✅
• push-then-unlabel → deploy runs (deploy group), teardown runs (teardown group); state lock serializes; end state = destroyed ✅
• close while creating → create finishes, teardown then destroys ✅

Takes effect on merge to main (pull_request workflows run from the base branch's workflow file).