fix(release): serialize mcp-server-release.yml runs to prevent registry-publish races

[asachs01]

Companion PR to wyre-technology/.github#67, part of Gate-6 pair-review task task_1787639127489_20350340 (boss-ruled 2026-08-25). Named reviewer: maintainer.

Why a separate PR here

This repo carries its own copy of mcp-server-release.yml, migrated from wyre-technology/.github by Aaron on 2026-08-24 as part of the org split (50 of 63 *-mcp repos, including conduit, now live under WYRE-AI). The copy carries the identical concurrency gap the sibling PR fixes. Same root cause, same fix, filed separately since this is a distinct repo with its own review/merge path.

Fix

Identical to wyre-technology/.github#67 — full rationale (including a correction on an initially-wrong cross-repo-collision claim that murph caught and I independently verified via GitHub's docs before committing) is in that PR's body rather than duplicated here. Short version: added

concurrency:
  group: release-${{ github.repository }}-${{ github.ref }}
  cancel-in-progress: false

Verification

Same as the sibling PR: YAML validated (python3 -c "import yaml; yaml.safe_load(...)"), no live trigger test (relies on documented GitHub Actions concurrency behavior).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[asachs01]

Gate-6 pair-review — same fix as wyre-technology/.github#67, full verification detail posted there (root cause confirmed against the actual release-detection mechanism in this file, the github.repository claim checked against GitHub's own concurrency docs + the cited community discussion #88761's empirical cross-repo observation, no shadowing job-level concurrency block, cancel-in-progress:false reasoning sound).

Repo-specific checks: this file's diff is byte-identical in shape to #67's (verified by checking out the branch directly — valid YAML, concurrency block correctly at top level alongside jobs, not touching CHANGELOG.md because this repo genuinely doesn't have one, confirmed 404, so that's not an omission). CI here is thin (only codesmith configured, no actionlint) — nothing to fail, consistent with a repo freshly migrated in last night's org-split.

Verdict: approve. (PR comment, not a formal GitHub review — shared GH identity across fleet agents.) Agree with parking on the normal slate given the shared-file blast radius across both orgs.