fix(release): separate site control from source

[wolfiesch]

Summary

• dispatch the site workflow from trusted main control while carrying the immutable release tag and commit as explicit inputs
• verify the tag-to-commit and source-to-control relationships before deployment
• build and deploy from a separate immutable release checkout
• retain verification compatibility with historical tagged release-control files

Why

The v0.1.31 binary release is published and its seven assets were verified, but the site deployment run failed before AWS authentication because the workflow was executed from the older tagged control graph. This keeps current deployment control on main without allowing mutable source content into the release site.

Failed site run: https://github.com/LycaonLLC/t4-code/actions/runs/30066136651

Verification

• focused release/site tests: 36 passed
• pnpm check
• pnpm lint
• pnpm test
• current verifier against an extracted v0.1.31 tag archive

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 11efa349b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".