fix(ci): require an identical workflow harness for evidence reuse

Codex review round three: a prior green run may have executed with
different lane definitions; the resolver now compares the candidate
run head SHA's .github/workflows tree against the current workflow
ref before accepting its manifest.

.github/workflows/full-release-validation.yml

@@ -303,6 +303,7 @@ jobs:
             }')"
           bash workflow/scripts/github/find-reusable-release-validation.sh \
             --target-sha "$TARGET_SHA" \
+            --workflow-sha "$GITHUB_SHA" \
             --release-profile "$RELEASE_PROFILE" \
             --run-release-soak "$RUN_RELEASE_SOAK" \
             --inputs-json "$inputs_json" \