Transparency of code-push versions

At the moment there's no way to tell what's actually deployed via CodePush, which makes collaboration and debugging unnecessarily hard.

* Auto-add the current Git SHA to the release description
* Deny CodePush releases with uncommitted changes, unpushed commits, or when not on the release branch (to avoid accidental promotes)
* Use the locally hosted bundle (by overriding `jsCodeLocation`) when working on the app on a locally connected device (to avoid clashing CodePush staging versions)

Start by locating the CodePush release flow and the app's jsCodeLocation handling. Review how release descriptions, Git state, the release branch, and locally connected devices are currently determined. Done means all three requested safeguards and transparency behaviors work without accidental CodePush promotes.

Written by the indexing model from the issue text.