fix(release): reuse publisher lockfile for canary smoke (#15712)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Every master push publishes an exact canary and tests its onboarding
flow.
> - The publisher resolves dependencies before building, while the smoke
job checks out the committed lockfile again.
> - Patch or manifest changes can land before the separate lockfile
refresh, so the smoke fails before testing the published app.
> - This pull request passes the publisher's resolved lockfile to the
same-source smoke job.
> - The smoke keeps frozen dependency validation and tests the exact
published canary version.

## Linked Issues or Issue Description

Refs #10393, #13689. Related work: #13690 documents lockfile drift;
#12115 addresses refresh-PR check triggering. This change addresses the
canary smoke handoff. #15678 only refreshed the opencode importer.
#15164 incidentally corrected the earlier patch hash on master.

**What happened?**

Canary publication succeeded, but the fresh onboarding smoke install
failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` on sources `0b80ea17ef`
and `ab8dcab809`. The committed `acpx@0.13.1` hash no longer matched its
patch. A later run on `6080daf262` failed with
`ERR_PNPM_OUTDATED_LOCKFILE` after an `opencode-ai` manifest addition.
The current master lockfile has since caught up; the workflow still
permits this race on future changes.

**Expected behavior**

The exact published canary reaches the onboarding smoke with test
dependencies resolved for its source. A mismatched or missing lockfile
must fail validation.

**Steps to reproduce**

Check out either affected source and run `pnpm install
--frozen-lockfile` with pnpm 9.15.4. The smoke fails before a browser
starts, although the publisher already installed that source with a
resolved lockfile.

## What Changed

- Pin both canary publisher and onboarding smoke checkouts to the
triggering SHA.
- Save the publisher's resolved lockfile before restoring tracked files
or rewriting release versions.
- Restore that same-run, source-named artifact before the unchanged
frozen smoke install.
- Add offline real-pnpm regressions for patch-hash and manifest drift,
plus wrong-source rejection and workflow binding checks.
- Document artifact retention and job reruns. No manifest or committed
lockfile changes.

## Verification

- Focused release workflow, exact-source verification and image-contract
tests: 45 passed.
- Negative control: both new real-pnpm fixture cases fail against the
original workflow with their respective original lockfile errors; both
pass with the handoff.
- `pnpm install --frozen-lockfile` passed on the current source.
- `pnpm -r typecheck` and `pnpm build` passed after reclaiming
disposable build-cache space.
- The browser onboarding smoke passed against exact published
`2026.1009.0-canary.7`: 1 test passed using a fresh temporary instance.
- Full local `pnpm test:run` was attempted twice. The first hit disk
exhaustion; the second reported one chat integration failure and then a
Vitest worker `ENOTCONN` crash before completing. This is not a
full-suite pass. The named chat case passed in isolation without
changes. All full sharded PR CI checks passed on the final head.
- Independent source review and a clean-checkout run also passed all 45
focused tests, with separate real-pnpm negative controls.
- The supply-chain scan is neutral because managed intelligence could
not scan the pinned official `download-artifact` action. It reported no
defect; independent review inspected the action source, same-run scope
and v4/v4 compatibility.
- Reviewed the diff for secrets, personal data and generated artifacts;
none found.

## Risks

- The smoke now depends on a same-run GitHub artifact retained for 14
days. A missing artifact intentionally fails instead of resolving a
different dependency set.
- A publisher rerun replaces its source-named artifact; a smoke-only
rerun reuses the retained artifact.
- Frozen validation and the exact published version remain required. The
source app and publication logic do not change.

## Model Used

OpenAI GPT-6 through Codex, with tool execution and parallel independent
review. The exact serving variant and context-window size are not
exposed in this session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>

.github/workflows/release.yml

@@ -354,6 +354,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
+          ref: ${{ github.sha }}
           fetch-depth: 0
 
       - name: Setup pnpm
@@ -373,6 +374,18 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      # Master can precede the separate lockfile-refresh PR. Preserve the
+      # resolution used for this build before release tooling restores the
+      # tracked lockfile or rewrites workspace versions.
+      - name: Save canary smoke lockfile
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: canary-smoke-lockfile-${{ github.sha }}
+          path: pnpm-lock.yaml
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
       - name: Restore tracked install-time changes
         run: git checkout -- pnpm-lock.yaml
 
@@ -447,6 +460,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
@@ -458,6 +474,13 @@ jobs:
         with:
           node-version: 24
 
+      # Default download scope is this workflow run, including job reruns.
+      # A missing artifact fails instead of resolving a different dependency set.
+      - name: Restore canary smoke lockfile
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: canary-smoke-lockfile-${{ github.sha }}
+
       - name: Install test dependencies
         run: pnpm install --frozen-lockfile