Deduplicate keep-around ref jobs for merge requests

What does this MR do and why?

One merge saves the merge request four times with merge_commit_sha set, so the after_commit callback fans out four identical jobs writing the same refs/keep-around/<sha>. On Gitaly Cluster they race in Praefect, and the canceled loser leaves a ref lockfile behind that freezes replication on the secondaries.

The worker inherited the default until_executing, which drops the lock the instant the job starts — before the WriteRef. until_executed holds it until the job finishes.

References

• #608179 (closed)
• gitaly#7331 (Gitaly-side lockfile bug, not fixed here)