Coalesce pending beta deploy runs

[steve8708]

Summary

• Add a workflow-level beta concurrency group so only the newest pending main push remains queued.
• Preserve the active fleet publish and its non-canceling per-site child queues.
• Update the workflow guard and regression test for the latest-only pending policy.

Validation

• corepack pnpm test:netlify-prebuilt-workflow
• corepack pnpm guard:netlify-prebuilt-workflow
• git diff --check

Deployment

Merges to main trigger the automatic prebuilt beta publisher. This PR does not claim beta is live until that post-merge workflow completes.

[github-actions]

Visual recap — generation failed

The visual recap could not be generated for this pull request. This is informational only and does not block the PR.

Diagnostic:

No plan URL: create-visual-recap failed 403 Forbidden: {"error":"Creating an org-visible visual recap requires an active organization. Connect Plan from an organization or publish with private visibility."}

Agent output: Authored and validated recap-source.json. CI can now publish it deterministically. --- ⠀ 🟢 Visual recap source is ready for PR #4532. stderr: Reading additional input from stdin... 2026-09-08T23:14:28.430755Z ERROR codex_core::tools::router: error=apply_patch verification failed: invalid patch: multiple operations target /home/runner/work/agent-native/agent-native/recap-source.json

[builder-io-integration]

Builder reviewed your changes — looks good ✅

Review Details

Incremental Code Review Summary

The latest changes address all previously reported deployment issues. Automatic and manual runs now have separate workflow-level groups, the reusable beta workflow separates per-site child queues by caller lane, and manual beta source_ref values must match the current main revision. The reusable workflow also performs a final freshness check immediately before upload, preventing stale queued work from publishing over a newer beta revision. I resolved both prior review threads.

The remaining issue is limited to guard robustness: the new validation assumes the beta workflow has a concurrency mapping and can throw while trying to report a missing or malformed configuration. This is low risk for the current valid workflow but weakens the guard's ability to diagnose exactly the regression it is meant to catch.

Key Findings

🟢 LOW — Guard crashes when beta concurrency is missing. Use optional access when checking cancel-in-progress, and add a mutation/fixture test for a missing concurrency block.

Overall risk: Standard, because this PR changes deployment orchestration and release-freshness safeguards. The runtime workflow behavior now matches the intended latest-only policy.

🧪 Browser testing: Skipped — PR only modifies deployment workflows and guard tests, with no user-facing UI impact.