feat(create-*): a pin is a commit SHA, not a name nobody moved yet

[y1o1]

The defect

--dplaax-module-ref rejected a denylist of six familiar branch names and
accepted everything else:

const KNOWN_MOVING_REFS = new Set(["main","master","develop","dev","head","trunk"]);

The comment above it claimed the CLI enforced "an exact tag". It did not.
release/2026-07, my-feature, HEAD~1 and every tag — all equally
movable — passed. release.pin.source-exact names this shape directly:

A denylist of known moving names is not a pin discipline — any branch is
movable. The generator accepts only what it can verify is immutable: a full
commit SHA.

The change

Inverted to the positive form — /^[0-9a-f]{40}$/, or nothing. Lowercase
because git resolves object ids in lowercase; accepting the other spelling
would give one commit two pin strings.

--allow-unpinned-ref is the mode boundary the rule implies by scoping its
requirement to a published-release mode. Iterating locally against a branch
is legitimate; publishing from one is not. The flag says in its own name what
it gives up, and a test pins that it is not also a bypass for a missing
value.

AUTH_REF loses its ARG AUTH_REF=poc default: a default here would have to be
a branch name — the very thing the requirement exists to keep out of a
published artifact. A POSIX-sh guard now fails the build early with a readable
message instead of failing deep inside the scaffold.

Blast radius

caller	effect
publish-images.yml	none — already passes github.sha
make instances	none — already passes git rev-parse HEAD
local docker build	must now pass an explicit SHA (no poc default)
a human running the CLI	must pass a SHA, or --allow-unpinned-ref

Test plan

Both generators, 108 + 95 passing:

• the six denylist names, still rejected — but now for the right reason;
• the refs the denylist could never have caught (v0.1.0, release/2026-07,
  my-feature, HEAD~1, deadbeef);
• both boundaries of the SHA shape — 39 hex chars, and 40 uppercase;
• the escape actually scaffolds (--allow-unpinned-ref → exit 0), which a
  rejection-only suite would have missed;
• the escape does not license a missing value.

Guard logic verified against all four input shapes in POSIX sh (the gen stage
is alpine, so bash-isms would not run).

Not in this PR

release.lock.frozen-graph — the builder stage still runs a bare
pnpm install, so the instance's transitive graph is resolved fresh at image
build time. Closing it properly means generating and testing the lockfile
before the image build, which restructures the publish path; raised separately
rather than half-done here.

🤖 Generated with Claude Code