STAC-25494 stagger godeps-cache builds instead of gating on concurrency

[LouisParkin]

The godeps-cache build job's concurrency group does not queue the three consumer workflows — it cancels one of them.

The bug

GitHub allows one running and one pending entry per concurrency group. A third entrant evicts the pending one, and cancel-in-progress: false does not change that — it only governs the running entry. Cancellation then propagates to the caller: dependent jobs are skipped and the whole run ends as cancelled.

Seen on #448 (run 30542704807, the workspace-tidy commit):

workflow	godeps-cache build	outcome
Binary builds	won the group, published in 6m29s	success
DEB package build	pending	ran
Lint and unit tests	cancelled after 3s	both unit suites and the tidiness gate skipped

It fires on precisely the PRs that change the module graph — the ones that most need the unit suites. And it reports cancelled, not failure, so it reads as "someone pushed again" rather than "your tests never ran".

The fix

Drop the group; stagger instead. godeps-cache.yml takes a build_delay_seconds input and, before building, polls the registry for the tag for that long, exiting early if a sibling publishes it.

• Lint and unit tests: 0 — designated builder. It is the longest workflow of the three, so it is the one that must not wait.
• Binary builds / DEB package build: 900 — covers a ~7m build plus runner scheduling.

Nothing is ever cancelled. If the builder fails or is slow, the waiters time out and build it themselves, so a bad sibling costs latency, not correctness. The idempotent pre-push docker manifest inspect stays as the backstop, and the tag is content-addressed, so a duplicate push is harmless.

Validation

• zizmor --collect=workflows,actions,dependabot . — no findings.
• All four workflows parse; the build step's shell passes bash -n.
• The real check is this PR itself: it does not touch the module graph, so the cache image already exists and all three godeps-cache jobs should short-circuit at the metadata lookup without entering the wait. Exercising the wait path needs a PR that changes go.mod — STAC-25466 tidy the Go workspace manifests #448 is that PR, and rebasing it onto this will show the three-way race resolving without a cancellation.

Jira: STAC-25494