fix(release): use validated site release identity

[wolfiesch]

Summary

• remove a stale reference to the pre-validation release tag input during immutable source resolution
• keep the resolved, validated release identity authoritative throughout deployment
• add a regression check that rejects reintroducing the stale assignment

Failure

The exact post-publication site run reached immutable source resolution, then failed under set -u because REQUESTED_RELEASE_TAG was no longer in that step's environment. The ordinary main-triggered immutable deployment had already succeeded.

Failed run: https://github.com/LycaonLLC/t4-code/actions/runs/30067499045

Verification

• focused release/site tests: 33 passed
• pnpm check
• pnpm test
• current verifier against an extracted v0.1.31 tag archive