Prevent alias tag overwrite on concurrent Docker publishes

[dash14]

Summary

When multiple version tags (e.g., v1.0.0 and v1.1.0) are pushed simultaneously, parallel workflow runs could overwrite the major and major.minor alias tags with an older version.

• Add concurrency group to serialize Docker publish workflow runs
• Add Git tag-based semver comparison to skip alias tag generation when the current version is not the latest within its major or major.minor range
• version (e.g., 1.0.0) and sha-xxx tags are always pushed as they are unique

How it works

Tag	v1.0.0 build	v1.1.0 build
1.0.0 / 1.1.0	push	push
sha-xxx	push	push
1.0 / 1.1	push	push
1	skip (v1.1.0 is latest)	push