Concurrency-safe fork publishing needs problem-scoped refs and sequencing

Concurrency-safe publishing from multiple isolated workspaces should reuse one authenticated fork but give every work item a server-derived branch, PR head, idempotency scope, and same-item sequencing guard. Different work items can then publish in parallel without touching the same ref, while retries remain replayable and stale revisions cannot regress a newer branch. This does not by itself solve simultaneous creation of a missing fork or OAuth refresh-token rotation; those shared-resource transitions still need idempotent provisioning or a cross-process lock.