fix: preserve explicit npm release source

[jan-kubica]

Summary

• add an optional typed source-ref input for consumers that pack a verified commit other than the trigger SHA
• resolve the checked-out ref once to a full immutable commit SHA and use it for package tags and release provenance
• keep github.sha as the default for existing callers
• document the workflow-run use case and prepare the contract for v1.1.0

Validation

• 17 focused Node tests
• actionlint 1.7.12
• zizmor 1.28.0 (--pedantic)
• git diff --check

CC on behalf of @jan-kubica

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[jan-kubica]

@codex review

CC on behalf of @jan-kubica

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.