Abort releases when main advances after version planning

Problem

The release workflow snapshots base_sha while computing the version, but the later merge only constrains the release PR head. With non-strict required status checks, newer commits on main can enter the merge commit and be built/tagged without being included in the version or release-note calculation.

Evidence: https://github.com/richardcase/clowder/blob/b5492d5/.github/workflows/release.yml#L75
Merge step: https://github.com/richardcase/clowder/blob/b5492d5/.github/workflows/release.yml#L406-L434
Build checkout: https://github.com/richardcase/clowder/blob/b5492d5/.github/workflows/release.yml#L478-L484

Acceptance criteria

• Before merging, require the default branch tip to equal the planned base_sha.
• Abort and require a fresh plan/retest when it has advanced.
• Add a workflow test or script-level guard for this race.

Start with .github/workflows/release.yml, especially the version-planning reference near line 75 and merge and build steps at lines 406-434 and 478-484. Trace how base_sha is captured and used, then add the pre-merge guard and a workflow test or script-level check for an advanced default branch. Done means the release aborts and requires a fresh plan/retest when main no longer matches base_sha.