ci: the two architectures push one at a time

The first run to exercise push-by-digest lost its arm64 leg to a 403 that
reads like a permissions failure and is not one: GHCR answers two simultaneous
pushes to the same package with a secondary rate limit. amd64 went through and
arm64 did not, which is the shape of a throughput limit rather than of a broken
credential.

Both legs push to the same package by construction, so the concurrency was mine
to remove rather than to retry around. A release path that fails intermittently
is worse than one that takes a minute longer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: MorningLightMountain713

.github/workflows/build.yml

@@ -87,6 +87,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
+      # One at a time. Both architectures push to the SAME package, and GHCR
+      # answers two simultaneous pushes to one package with a secondary rate
+      # limit - a 403 that reads like a permissions failure and is not one. It
+      # cost the first run its arm64 leg while amd64 went through, which is the
+      # shape of a throughput limit rather than of a broken credential.
+      #
+      # The minute this adds is worth it on a path that publishes: a release
+      # that fails intermittently is worse than one that takes longer.
+      max-parallel: 1
       matrix:
         include:
           - platform: linux/amd64