Pin release workflow actions and verify tag ancestry before publication #158

Part of #93. Follow-up to #137 and Irzhy's F1/F2 review of PR #138.

Owner: Anders (@andersalm). Task base and PR target: develop.

The release workflow uses reviewed action commits and checks that each version tag belongs to the approved stable source line before publication.

Done means:

• Every action in ci.yml and release-package.yml is pinned to a full commit SHA with a version comment, and scripts/ci-release-policy-test.py requires it (ci.yml pins merged with ci: update from the real published alpha.6 to each PR build, then Undo with --rollback-to (#89, #109) #259).
• GitHub Actions Dependabot keeps those pins current (no .github/dependabot.yml yet).
• Before downloading release assets, the release job checks out full history and rejects a tag commit outside origin/main. A policy test checks the guard's position before publication.
• Dependency caching (ci: verified cache for Kubo and apt inputs, so slow downloads stop failing CI (#194) #268) stays separate from this guard. Cache and publication matrices retain their accepted behavior. Required checks and independent model reviews pass before merge (rule, 10 Oct, #89).

Anders owns tag rulesets, release-environment reviewers and repository access settings. Add the workflow environment reference only after he configures and approves that environment. This code task preserves existing tags and releases.