fix(release): separate repair control from source

[wolfiesch]

Root cause

The manual repair workflow checked out current trusted release-control first, but then replaced the workspace with the immutable historical tag before invoking the consistency verifier. A verifier repair on current main therefore could not repair an already-tagged release.

Fix

• keep current trusted release-control at the workspace root
• check the immutable release source into .release-source
• add --repo-root to the dependency-free verifier
• run current trusted verifier code against the immutable source tree
• add a regression test for the source/control separation

Verification

• all 24 release-consistency tests pass
• full tooling suite passes
• pnpm check passes
• extracted immutable v0.1.31 source passes when verified by current control code with no source dependencies installed

This preserves the immutable tag and makes the documented historical-repair path executable.