Serialize hastegeo-publish workflow runs to fix RC version race in "prepare" - #190

Description

Job prepare in Publish hastegeo wheel and images was failing with ValueError: Not a valid wheel ZIP file: .... Root cause: two concurrent PR builds independently resolved the same "next" RC number (e.g. 1.0.40rc1), since publish-rc's concurrency group only serialized publishing, not the earlier prepare job where the version is computed. Whichever run published second permanently broke — its prepare job kept re-resolving to a higher RC number (rc2, rc3, ...) on every retry, but its build artifact was fixed at build time to the original (now-taken) name, so the expected file could never be found.

Fix

• Add a workflow-level concurrency group (hastegeo-publish, cancel-in-progress: false) to hastegeo-publish.yml, serializing entire runs end-to-end instead of only the publish-rc job. This guarantees prepare always resolves against the fully up-to-date release state.
• Improve publish_hastegeo_wheel.py's validate_wheel to raise a clear, actionable error when the expected wheel file is simply missing, rather than the misleading "invalid ZIP" message.
• Add regression tests covering the new workflow concurrency requirement and the clearer missing-file error.

Note

This closes the race for future runs. The specific stuck PR whose build artifact is permanently named with an already-taken RC number still needs a fresh build to pick up the next available version — no code change can retroactively rename an already-built artifact.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that changes existing behavior)
• Documentation update
• Infrastructure / CI change

Checklist

• I have read CONTRIBUTING.md
• My changes follow the project's coding standards (PEP 8 for Python, ESLint rules for JS/TS)
• I have added or updated tests that cover my changes
• Python tests pass locally (cd hastelib && hatch run test:pytest) and the UI lints clean (cd ui && npm run lint)
• I have updated the relevant documentation (README, docs/, inline comments)
• I have added an entry to CHANGELOG.md if this is a user-facing change

Testing

Ran the full hastelib/tests/build suite (python -m unittest discover -s hastelib/tests/build) — 53 tests pass, including two new regression tests (test_publish_workflow_runs_are_serialized, test_validate_wheel_reports_missing_file_clearly). Verified the updated YAML parses cleanly and ran codeql_checker with 0 alerts.

Additional context

Diagnosed via GitHub Actions logs for run 33539011240: attempt 1's publish-rc failed with "Release asset already exists" for hastegeo-1.0.40rc1-py3-none-any.whl (published by a concurrent run in the ~20s window after prepare re-resolved but before publish-rc uploaded); attempts 2–4 then failed in prepare itself as it kept resolving higher RC numbers against a build artifact stuck on rc1.