feat: per-callback concurrency overrides

[joshua-temple]

Problem

Global concurrency: in ci.config applies to the orchestrate workflow per ref. Individual callbacks can't declare their own concurrency, so deploys to the same env can race when triggered from different refs (e.g., a dev branch push lands while a test-env promotion is mid-deploy).

Proposed

Optional concurrency: field on build/deploy entries:

deploys:
  - name: kubernetes
    concurrency:
      group: "k8s-${{ inputs.target_env }}"
      cancel_in_progress: false

Generator emits this onto the generated job alongside the existing global concurrency.

Impact

Prevents concurrent deploys to the same env without forcing callback authors to hand-roll concurrency at the workflow file level (which then drifts from framework intent).