ci(uat): serialize deploys + force-sync host repo to remote

Rapid pushes to uat ran the deploy concurrently (no concurrency guard), racing the
same containers/host /code repo and leaving UAT serving a stale bundle:
- Add a concurrency group (cancel-in-progress:false) so deploys queue, never overlap.
- Replace `git merge origin/uat` with `git checkout -f uat && git reset --hard
  origin/uat` so the host repo always matches remote exactly, self-healing a stuck
  checkout from a collided run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-uat.yml

@@ -1,4 +1,8 @@
 name: Deploy UAT
+# Serialize deploys — never let pushes race the same containers/host repo.
+concurrency:
+  group: deploy-uat
+  cancel-in-progress: false
 on:
   push:
     branches:
@@ -73,7 +77,9 @@ jobs:
             docker:28-cli \
             sh -c '
               apk add --no-cache git 2>/dev/null
-              git fetch origin uat && git checkout uat && git merge origin/uat
+              # Force the host repo to exactly match remote — self-heals a stuck/dirty
+              # checkout left by an earlier collided run (a plain merge can get stranded).
+              git fetch origin uat && git checkout -f uat && git reset --hard origin/uat
               docker compose -f docker-compose.uat.yml -p sapl-sapl-uat up -d --build --remove-orphans
             ' 2>&1