Harden publish workflow: fix ancestry guard, serialize releases, bound runtime

Apply the fixes validated on the passport-intercom and cli publish
workflows:
- verify: use fetch-depth: 0 and drop the manual `git fetch --depth=1`,
  so the default-branch ancestry check has the history it needs (the
  double-shallow version could only pass when the tag was the branch tip)
- add a top-level concurrency group so overlapping releases serialize
  instead of racing for a dist-tag
- add timeout-minutes: 15 to stage-publish

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: patocallaghan

.github/workflows/publish.yml

@@ -7,12 +7,18 @@ on:
 permissions:
   contents: read              # workflow default (least privilege); only stage-publish also needs id-token, granted on that job
 
+concurrency:
+  group: publish-${{ github.workflow }}   # serialize all publish runs; never two staged releases racing for a dist-tag
+  cancel-in-progress: false               # queue, don't cancel: killing a half-done `npm stage publish` is the torn state we're avoiding
+
 jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
-        with: { persist-credentials: false }
+        with:
+          persist-credentials: false
+          fetch-depth: 0                   # full history so origin/<default> ancestry is computable; checkout fetches authenticated before stripping creds
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'      # pin >= 22.14.0
@@ -28,13 +34,13 @@ jobs:
           RELEASE_TAG: ${{ github.event.release.tag_name }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
-          git fetch origin "$DEFAULT_BRANCH" --depth=1
           git merge-base --is-ancestor "$GITHUB_SHA" "origin/$DEFAULT_BRANCH" \
             || { echo "release $RELEASE_TAG not reachable from $DEFAULT_BRANCH — refusing"; exit 1; }
 
   stage-publish:
     needs: verify
     runs-on: ubuntu-latest
+    timeout-minutes: 15         # bound a hung publish instead of running to the 6h default
     permissions:
       contents: read
       id-token: write           # OIDC trusted publishing: only this job mints the token