fix(ci): pin tag release reusable workflows

[drew]

Summary

Pin tag release Docker and e2e reusable workflows to the resolved release tag commit so manually dispatched tag releases do not build or test the dispatch ref.

Related Issue

None

Changes

• Resolve the release tag commit once in release-tag.yml and expose it as source_sha.
• Pass checkout-ref and source_sha through Docker build and e2e reusable workflows.
• Use source_sha for GHCR release retagging and downstream wheel publish metadata.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1235.docs.buildwithfern.com/openshell