fix: add concurrency control to sharing-server deploy workflow

Prevent concurrent Terraform runs from conflicting on the same Azure Blob
Storage state file. Without concurrency serialization, two pushes to the
same branch can trigger simultaneous deploy jobs that both try to acquire
the same state lock, causing 'state blob is already locked' failures.

- For branch pushes (testing): cancel-in-progress so new commits don't
  wait behind stale deploys.
- For main (production): queue (cancel-in-progress=false) so production
  deploys always complete rather than being cancelled mid-apply.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: rajbos

.github/workflows/sharing-server-deploy.yml

@@ -11,6 +11,14 @@ on:
       - ".github/workflows/sharing-server-deploy.yml"
   workflow_dispatch:
 
+# One deploy per branch at a time — prevents concurrent Terraform runs from
+# conflicting on the same remote state file (state blob already locked errors).
+# Cancel in-progress for branch pushes so stale deploys don't block newer ones;
+# queue (no cancel) for main so production deploys always complete.
+concurrency:
+  group: sharing-server-deploy-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 # Minimal baseline; jobs declare only what they need.
 permissions:
   contents: read