fix(scripts): decouple release detector from fork remotes

[realsigridjin]

Summary

• fetch pi-mono release tags and main from the explicit upstream repository URL
• avoid treating a contributor fork's conventional upstream remote as badlogic/pi-mono
• exercise the detector with a conflicting contributor remote and verify output SHAs against the real remote

Verification

• node --test scripts/check-upstream-release.test.mjs
• npm run test:scripts (48/48 passed)
• npm run check
• npm run build

Notes

• The separate OpenAI compaction id: custom fix is already merged in fix: omit invalid "custom" item ids when replaying custom tool calls to the Responses API #271 and is intentionally not duplicated here.
• A full local npm test on Node 25 reached two unrelated baseline failures: npm 11 config warnings captured by an install test and a 1 ms timestamp precision assertion. The affected script suite is fully green.

---

Summary by cubic

Decoupled the upstream release detector from contributor remotes to always read releases and main from the real badlogic/pi-mono repository. Prevents false positives when a fork has an upstream remote pointing elsewhere.

• Bug Fixes
  • Use the explicit upstream URL for all git ls-remote and git fetch calls (no reliance on a local upstream remote).
  • Fetch refs/heads/main into refs/remotes/pi-mono/main and resolve SHAs from that ref for consistency.
  • Tests simulate a conflicting upstream remote, verify SHAs via the real upstream URL, and restore original remotes after.
  • Tests handle offline/credential-less environments and set GITHUB_OUTPUT to avoid output file writes.

^{Written for commit 222bc69. Summary will update on new commits.}