Load reusable workflow helpers from release tag

[chubes4]

Summary

• require callers to supply an exact vX.Y.Z wp_codebox_release_ref matching the reusable workflow uses: tag
• load helpers only from Automattic/wp-codebox, then verify the remote tag commit and matching package version
• add interface coverage and paired consumer fixtures for matching, mismatched, branch, and SHA references

Fixes #1759

Release context

• Builds on v0.12.3.

Compatibility impact

• This reusable-workflow interface change requires callers to replace branch or arbitrary refs with an exact release tag in both uses: ...@vX.Y.Z and with.wp_codebox_release_ref: vX.Y.Z. Existing caller-token, external-package, and secret-isolation behavior is unchanged.

How to test

1. Run npm run build.
2. Run npm run test:agent-task-contracts.
3. Run npm run test:redaction.
4. Run npm run test:production-boundary-enforcement.
5. Run npm run test:runtime-tool-policy.
6. Run go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/run-agent-task.yml.
7. Run git diff --check.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI gpt-5.6-terra and OpenCode
• Used for: Implemented the release-coherence validation, contract fixtures, tests, and documentation with Chris Huber's direction.