fix(ci): align integration inputs with release candidate source

[SDAChess]

Summary

Keep release-candidate integration tests, runtime images, and packaged test inputs on the same source commit as the candidate binaries. A manually dispatched Release Tag run can have a workflow head SHA different from the resolved release tag; previously, integration preparation used the workflow head SHA.

Related Issue

Related to #2860 (RFC 0014).
No separate issue required: this is a localized bug fix to existing candidate qualification wiring.

Changes

• Add an optional source-sha input to shared integration preparation, preserving the artifact-run head SHA fallback.
• Pass the resolved candidate source SHA from Release Tag.
• Expose the override for manual Integration Tests runs and document its use in CI.md.

Testing

• Actionlint passed for the modified workflows and their Release Dev / Branch E2E callers.
• Resolver shell checks: explicit candidate SHA overrides a different run head without an API lookup; omitted SHA preserves the fallback; API failures propagate.
• Markdown lint passed across 142 files (Nix-provided markdownlint-cli2 0.21.0).
• git diff --check passed.
• Zizmor run: three pre-existing high-severity unpinned CI-image findings and one informational finding in Release Tag; no findings introduced by this change.
• mise run pre-commit and mise run ci: attempted, but mise is not installed in this environment.
• Live release/integration workflow validation not run locally.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Related skills reviewed using the sync-agent-infra maintenance map; no updates needed
• CI documentation updated; architecture documentation not applicable

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4048.docs.buildwithfern.com/openshell