Addresses review feedback that the check-freshness gate and the
build-deploy concurrency group leave a window where a stale run can
still win the concurrency group and overwrite a fresher deploy. Since
the destination repo is only touched at the final push step, re-check
freshness right there and skip the push if master has moved on.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>