feat(ci): don't rebuild ci image twice for different jobs

.github/actions/run-in-ci-image/action.yml

@@ -51,4 +51,4 @@ runs:
           --workdir "$PWD" \
           "${env_args[@]}" \
           "$INPUT_IMAGE" \
-          bash -o pipefail -c "$INPUT_RUN"
+          bash -e -o pipefail -c "$INPUT_RUN"

.github/workflows/ci-image.yml

@@ -1,5 +1,9 @@
 name: CI image
 
+concurrency:
+  group: ci-image-${{ github.sha }}
+  cancel-in-progress: false
+
 # Resolves the CI image the calling workflow's jobs run in, building and pushing
 # it only when it isn't published yet.
 on: