ci: prevent stale-head releases

[abrichr]

Summary

• recheck protected main after exact-head release evidence finishes
• refuse semantic publication if main advanced during the wait
• pin every remaining mutable GitHub Action in Flow workflows
• enforce immutable action revisions across all workflow files

Verification

• UV_CACHE_DIR=/tmp/uv-cache-openadapt-flow uv run --frozen pytest -q tests/test_release_contract.py
• UV_CACHE_DIR=/tmp/uv-cache-openadapt-flow uv run --frozen ruff check tests/test_release_contract.py
• UV_CACHE_DIR=/tmp/uv-cache-openadapt-flow uv run --frozen ruff format --check tests/test_release_contract.py
• parsed all workflow YAML files with PyYAML

This PR is independent of Capture 1.3.0 and is ready for review.