fix(release): keep mobile candidates pinned as branches advance (#8454)

Mobile candidate publication currently fails if the source branch
advances after selection, and the operator can report failure even after
the correct immutable tag was created. It also prevents releasing an
explicitly selected historical baseline.

Add `--commit FULL_SHA` and independently verify in the operator and
publisher that the selected commit belongs to the selected source
branch's history. Compare immutable SHAs, keep the candidate pinned
through publication, and verify the resulting annotated tag instead of
requiring the branch to remain stationary. Stable-branch review/check
protection and immutable-tag permissions remain enforced. Without
`--commit`, selection still defaults to the current source tip.

### Validation

- Updated operator and publisher contracts pass: historical main/stable
selection, branch advancement during publication, unrelated or missing
commits, ancestry lookup failure, and unchanged tag/sequence checks.
- Removing ancestry enforcement causes the unrelated-history regression
to fail.
- Live read-only ancestry verification accepts the original 0.24
baseline. Local publication stops at the existing App-permission check;
no tag or build was created.
- Full local `just ci` passed.

Signed-off-by: Tom Brow <tomb@block.xyz>

scripts/mobile-release-source.sh

@@ -42,3 +42,17 @@ require_mobile_release_branch_ruleset() {
     return 1
   }
 }
+
+# Compare immutable SHAs, not a mutable branch name. The selected branch may
+# advance after this snapshot without changing the authorized candidate source.
+require_mobile_release_commit_ancestor() {
+  local target_sha="$1" source_sha="$2" merge_base
+  merge_base="$(gh api "repos/block/buzz/compare/$target_sha...$source_sha" --jq .merge_base_commit.sha)" || {
+    echo "Could not verify candidate source ancestry" >&2
+    return 1
+  }
+  [[ "$merge_base" == "$target_sha" ]] || {
+    echo "Candidate commit $target_sha is not in selected source history at $source_sha" >&2
+    return 1
+  }
+}