feat(release): support version-matched mobile stable branches (#8430)

Mobile candidates currently require the current `main` commit, so a
stable release branch cannot publish through the existing protected tag
workflow.

Add optional `--source-branch mobile-vMAJOR.MINOR` selection while
preserving `main` as the default. Both the command and App-backed
publisher reject a stable branch whose major/minor differs from the
requested version. Candidates retain exact-tip checks and immutable
annotated tags; the private build pipeline is unchanged.

Document the temporary stable-only distribution policy and explicit
per-fix backport decisions. No candidate, build, or upload is triggered
by this change. No duplicate implementation was found among open release
PRs.

Stable publication now checks active review and status-check protection
in both the operator and publisher. The process permits approved
backport PRs and stable-only corrections for regressions caused by
earlier backports. Administrator activation and verification of the
no-bypass ruleset remain outstanding; non-admin API responses hide the
bypass actor list.

### Validation

- Full local `just ci` passed during preparation; the final changes
affect shell release tooling, its workflow inputs, CI path detection,
and documentation.
- Publisher contract passed, including version-matched stable sources
and mismatched branch rejection.
- Operator contract covers default main, a divergent stable commit,
missing or mismatched sources, immutable sequencing, and publication
races. The final operator contract run passed.


- Updated publisher and operator contracts pass, including 17
weakened-policy cases and rejection of unavailable protection. The live,
currently unprotected stable branch is rejected.

---------

Signed-off-by: Tom Brow <tomb@block.xyz>

.github/workflows/ci.yml

@@ -91,6 +91,7 @@ jobs:
               - 'Justfile'
               - 'scripts/test-mobile-gateway-recipes.sh'
               - 'scripts/mobile-release.sh'
+              - 'scripts/mobile-release-source.sh'
               - 'scripts/mobile-worktree-overrides.sh'
               - 'scripts/mobile-worktree-clean.sh'
               - 'scripts/publish-mobile-release-candidate.sh'

.github/workflows/mobile-release-candidate.yml

@@ -12,8 +12,13 @@ on:
         description: Expected next release-candidate number
         required: true
         type: string
+      source_branch:
+        description: Source branch (main or mobile-vMAJOR.MINOR matching version)
+        required: true
+        default: main
+        type: string
       target_sha:
-        description: Exact current block/buzz main commit
+        description: Exact current source branch commit
         required: true
         type: string
 
@@ -65,5 +70,6 @@ jobs:
           GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
           MOBILE_VERSION: ${{ inputs.version }}
           CANDIDATE_NUMBER: ${{ inputs.candidate_number }}
+          SOURCE_BRANCH: ${{ inputs.source_branch }}
           TARGET_SHA: ${{ inputs.target_sha }}
-        run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA"
+        run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA" "$SOURCE_BRANCH"