fix(ci): fence nightly forward-roll baseline to proven ancestor

[Flandern1211]

Summary

The forward-roll baseline was selected from the live npm nightly tag without proving that the published build came from a commit reachable from the checkout under test. This could make the qualification run against a future or otherwise unverifiable baseline.

This change:

• reads the Nightly source commit from npm's SLSA provenance attestation, because tarball publication leaves gitHead unset;
• verifies the source commit with git merge-base --is-ancestor before the forward roll;
• fails closed when provenance is missing, the commit is invalid, or Git history is unavailable, while distinguishing a genuine non-ancestor result;
• makes the CLI validation checkout full-history and adds the release script/workflow paths to its trigger list;
• carries the proven source commit through predecessor evidence and revalidates it before release mutations;
• adds deterministic provenance, ancestry, revalidation, shallow-history, and workflow-policy coverage.

Fixes #4447

Review focus

The earlier #4604 implementation used gitHead, which is null for current maka-agent Nightly tarball publications, and assumed full Git history in a validation lane that used the checkout default. This PR uses the live SLSA endpoint and explicitly sets fetch-depth: 0 in the affected qualification job.

The issue discussion did not receive a direct maintainer confirmation before implementation; the corrected scope follows the provenance direction and P0 findings recorded in the #4604 review. The PR is intentionally limited to the release publication script, its tests, and the affected workflows.

Verification

• node --test --test-concurrency=1 scripts/release-cli-publication.test.mjs scripts/release-cli-workflow-policy.test.mjs — 34 passed, 0 failed
• npm exec -- biome check scripts/release-cli-publication.mjs scripts/release-cli-publication.test.mjs scripts/release-cli-workflow-policy.test.mjs — passed
• npm exec biome lint scripts/release-cli-publication.mjs scripts/release-cli-publication.test.mjs scripts/release-cli-workflow-policy.test.mjs — passed
• npm run format:check — passed
• git diff --check — passed
• YAML parsing for all four changed workflows — passed
• npm --workspace @maka/runtime-host run build — passed
• Live resolver check against the current npm Nightly — passed; source commit 00f2c9e0e3bf6ee443e65b9c2c35c8dc66d77f9d was resolved and verified as an ancestor of the checkout
• npm run check:asf-npm, npm run check:product-release-identity, and npm run check:model-metadata — passed

npm run build was also attempted. It reached the UI build and failed on pre-existing current-main TypeScript/API mismatches in untouched UI files (settledText, autoScroll, and trailingAction). npm run check:release was attempted but stopped at the repository's stale-dist guard because this clean clone had no desktop dist outputs. These failures are outside the changed files.

Historical review

Successful related release/qualification PRs reviewed: #4313, #3481, #4131, and #3192. They consistently bind registry/release evidence to exact immutable identities, keep qualification in the existing release path, and add deterministic policy tests.

Unsuccessful or superseded related PRs reviewed: #4604 (CLOSED, invalid gitHead premise and shallow-history assumption), #4418 (CLOSED, superseded by #4412), and #3241 (CLOSED, redirected to broader release-verifier work). This PR avoids #4604's metadata assumption and explicitly covers the checkout-depth failure mode.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex investigated #4447, implemented the provenance/ancestry fence and tests, ran the verification commands, and reviewed the resulting diff. An independent review pass caught and fixed the missing source-commit environment binding in the final revalidation step.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally; targeted script lint/format and Runtime Host build pass, while the full build/typecheck is blocked by existing UI errors described above

Does this PR entail a change in behavior?

• Yes — forward-roll validation now fails closed when the selected Nightly source cannot be proven to precede the checkout
• No