Make npm publish resilient to concurrent pushes to main

[livenson]

Problem

The publish-npm job fails intermittently on the git push, aborting the release:

npm version prerelease --preid=dev
git push
 ! [rejected]        main -> main (fetch first)
error: failed to push some refs to 'https://github.com/waldur/js-client'
hint: Updates were rejected because the remote contains work that you do not
hint: have locally. This is usually caused by another repository pushing to
hint: the same ref.
##[error]Process completed with exit code 1

The job checks out main, runs npm version prerelease (which creates a version-bump commit), then pushes it back to main. If main advances between checkout and push — e.g. a concurrent SDK-regen push to src/**, or another publish-npm run — the bare git push is a non-fast-forward and is rejected, so the publish never happens. This is a well-known GitHub Actions publish race.

Fix

• concurrency group (publish-npm, cancel-in-progress: false) so publish runs are serialized instead of racing each other; queued runs still publish rather than being cancelled.
• Rebase-and-retry around the push (git push origin HEAD:main → on rejection git pull --rebase origin main and retry, up to 5 times with backoff) so a push from another workflow (e.g. the SDK regen, which touches disjoint src/** files) no longer fails the release.

No change to publish auth or versioning behavior.

Out of scope — separate blocker

Some runs also fail later at npm publish itself with npm error 404 ... PUT https://registry.npmjs.org/waldur-js-client. That is an npm-side authentication/trusted-publisher problem (the workflow uses OIDC provenance via id-token: write), not something this PR can fix — it needs the npm waldur-js-client trusted-publisher / token configuration checked by a maintainer. Filing this note so it isn't lost.

Testing

YAML validated locally. Best verified by watching the next main publish run (or a workflow_dispatch) complete without the fetch-first rejection.

🤖 Generated with Claude Code