Consider small refactoring improvements to the main CI workflow

Some things I noticed, not all of them may require fixing:

• The current CI builds the Docker image four times in total, for checking and testing the Python and JS. These are all parallel steps, so it's probably not a big deal.
• We compress the Docker image with gzip, when we could use zstd.
• The deploy has the same lack of correct concurrency lock, that job-server's CI did. It's locking on the deploy step, not the whole workflow, which means two deploys at around the same time could run out of order, if the second run reaches deploy before the first run.
• We don't build the Docker image for job-server's analogous checks; we run them on the code directly. Whether that's better or not, I'm not completely sure.

Start by inspecting the repository's main CI workflow and compare its deploy concurrency with the linked job-server CI commit. Review the four image-build paths, gzip compression, and job-server checks; done means the agreed CI improvements are implemented and workflow behavior is validated.