Coordinate source-snapshot writes with the primary rolling publisher

[mark-e-deyoung]

Problem

The rolling channel is mutated by two workflows:

1. compile-observer-smoke.yml publishes binaries + initial manifest/checksums;
2. experimental-source-snapshot.yml later clobbers the manifest/checksums and adds the exact source archive.

The source workflow currently uses its own concurrency group (semper-exp-source-snapshot) rather than the primary publisher's mutation serialization, and it validates the rolling manifest near the beginning of the job rather than immediately before the final release upload.

A reproducible race is therefore possible:

1. candidate A primary publish succeeds;
2. source workflow A validates manifest A and starts building source A;
3. candidate B primary publish succeeds and moves/replaces the rolling channel with B;
4. source workflow A later runs gh release upload ... --clobber and overwrites the rolling manifest/checksums with A evidence.

Cancellation of A's source workflow is not sufficient by itself because cancellation is cooperative and the write may already be reachable.

Required behavior

All write-capable mutations of semper-exp-current must be serialized against each other and must fail closed if their candidate is no longer current immediately before mutation.

Evaluate the smallest implementation, likely:

• use a shared rolling-channel mutation concurrency group across the primary publisher and source-snapshot writer;
• before source upload, re-resolve semper/compile-observer head and semper-exp-current tag and require both to equal GITHUB_SHA;
• re-read the current rolling manifest immediately before mutation and require source.commit == GITHUB_SHA;
• after upload, verify tag + manifest + platform artifacts + source archive all identify the same candidate.

Acceptance

• source A can never overwrite any portion of rolling candidate B;
• a newer push supersedes/cancels older source publication safely;
• branch head, tag target, manifest source commit, source archive commit and platform artifacts remain one candidate;
• a source-snapshot failure cannot leave the rolling manifest mislabeled for a different candidate;
• recovery/retry is reproducible and idempotent;
• no private validator material is introduced.

Related to #3 (primary publisher ordering) and #8 (rolling publication consistency).