Prevent maintenance workflow push races

[JarryShaw]

Summary

• serialize the Conda and Vendor maintenance writer jobs with a shared concurrency group
• rebase generated commits onto the latest main branch before pushing
• prevent the fetch-first rejection observed in Vendor Update run 32527152872

Verification

• inspected the failed job log and confirmed Conda Update advanced main during Vendor Update
• validated all workflow YAML files locally
• checked the patch with git diff --check