Add an optional 'sourceRef' workflow_dispatch input (default empty =
this branch, normally main). When set to a tag/branch/SHA it is passed
to the reusable release workflow's 'ref' so historical source is built
and signed with the current pipeline, and the new release tag is pinned
to that commit via 'target'.