Removing the WorkingDir.GitReadLock() around step execution means Clone()/MergeAgain() (which take a git write lock and can reset/merge the workspace) may now run concurrently with terraform steps in the same PR/workspace. That can mutate the working tree mid-plan/apply, leading to inconsistent results or intermittent failures under parallel execution.

Consider keeping a shared read lock while running steps, and instead addressing the parallelism bottleneck by changing WorkingDir.Clone/MergeAgain to avoid taking the write lock when they are effectively no-ops (e.g., acquire a read lock to check whether the workspace is already at the desired ref and only upgrade to a write lock when an update/merge is actually needed), or by cloning/merging once per PR/workspace before starting parallel project workers.

I beleive we already get a proper lock with

	// Acquire internal lock for the directory we're going to operate in.
	unlockFn, err := p.WorkingDirLocker.TryLock(ctx.Pull.BaseRepo.FullName, ctx.Pull.Num, ctx.Workspace, ctx.RepoRelDir, ctx.ProjectName, command.Plan)
	if err != nil {
		return nil, "", err
	}
	defer unlockFn()	

in doPlan and doApply.