feat: support immutable core-ref overrides

[kentwelcome]

Summary

• Add optional core-ref input accepting a full lowercase 40-character core commit SHA; retain the release pin by default.
• Freeze core_revision in selection schema 2; run and publish inherit it and reject conflicting inputs.
• Fetch from the fixed core repository, verify checkout identity, and publish the full selected SHA. Reject artifacts from another revision.
• Document executable-code trust requirements and the clean selection-schema cutover. Use the same Action version in all three jobs.

Verification

• 79 deterministic tests passed; Python compilation passed.
• Action metadata JSON schema, Actionlint 1.7.7, and git diff --check passed.
• Installed default core 5b325ed40062bb819c574e4172da04f53b53b953 and override a5dacb04b26b6562cff6759004251888f7250ef5; verified exact checkouts and ran each actual runner with --help.
• Two independent read-only AI reviewers approved the complete patch.

Limits and scope

No model calls or live GitHub execution were performed. This does not change the dogfood workflow or forward CI environment variables. CI report headers need a separate validated-metadata integration. Core overrides run executable code with model credentials and require review of that exact SHA.

[kentwelcome]

Independent AI review — round 1

Reviewed the complete 11-file local patch against base d0ca905, then committed it unchanged with DCO sign-off as d64c7cf. Confirmed the published PR head matches that commit.

• CoreCorrectness: APPROVE. No material findings or decisions required. Traced input through frozen selection, fixed-repository installation, result record, and artifact validation/publication. Optional suggestion: add deterministic installer coverage for nondefault fetch/checkout and mismatching HEAD. Nonblocking; actual default and override installations were smoke-tested. No additional test added in this patch.
• CoreSecurity: APPROVE. No material findings, decisions, or optional suggestions. Confirmed strict immutable input, verified checkout, unchanged credential isolation, exact artifact selection matching, and documented executable-code trust requirements.

Scope audit: one optional input, selection schema-2 core identity, consistency checks, provenance, documentation and regression tests. Removed schema-1 selection acceptance and default-only publication provenance. No dependency pin changes, repository override, CI environment forwarding, dogfood workflow changes, or extra model calls. No unauthorized scope found.

Primary-agent verification: 79 deterministic tests; Python compilation; Action metadata schema; Actionlint 1.7.7; whitespace check. Actual default and override core installation, exact SHA verification and runner --help succeeded. Reviewers were read-only and did not repeat checks.

Limits: no live model calls or hosted Action execution. Approval is from independent AI subagents, not a human GitHub approval. No merge authorized or performed.