v1.1.1 — release guard finds the build's commit

Fixes the guard in `release-image.yml`, found on first contact with a real repo.

The bug. The guard demanded the promoted digest be tagged with the ref HEAD sha. But build workflows carry paths filters, so a docs- or CI-only commit moves the branch without producing an image — and from then on the repo cannot be released at all until someone touches a build input. Topology hit it immediately: adding its own release workflow is such a commit.

The fix. Walk back from the ref and find the most recent commit whose per-commit tag carries this digest. That keeps what the check bought — proof the image came from this branch, not a stale or foreign build — and answers a question the first version never asked: which commit is this image? The git tag is now created on that commit, so a version names code that is actually in it.

Also rejects a multi-image release whose images resolve to different build commits, rather than shipping a mismatched pair.

Cost. One crane ls per image, then local matching — Topology already has 65 tags, so the naive approach is a registry round trip per commit per tag form. New verify-depth input (default 50) bounds the search.

Verified against the live registry both ways before shipping: HEAD-is-the-build resolves at 0 behind; a CI-only commit on top resolves to the build 1 behind, which previously failed outright.

Why patch. A fix, and no caller changes anything to take it.