Load reusable workflow helpers from the same release

[chubes4]

Problem

WP Codebox v0.12.3 contains the caller-token fix, but run-agent-task.yml still checks out helper scripts from 54c2f9a, before that fix. Invoking the released workflow therefore executes older helper behavior.

Required outcome

• A released reusable workflow loads helpers from the same immutable WP Codebox release tag.
• Workflow source and helper/runtime source cannot drift.
• Release-version validation fails if the workflow helper ref differs from the package version/tag.
• Docs Agent can reference one immutable release tag rather than coordinating workflow and helper commit pins.
• Add contract coverage and document release advancement.

Follow-up to #1756 and #1758. v0.12.3 release: https://github.com/Automattic/wp-codebox/releases/tag/v0.12.3