Separate workflow helpers from release assets

[chubes4]

Summary

• add an optional immutable wp_codebox_workflow_ref for reusable-workflow helper scripts
• preserve wp_codebox_release_ref exclusively for packaged runtime release assets and version validation
• default helper selection to the release tag for existing consumers

Root cause

A reusable workflow invoked at an accepted commit checked its helper scripts back out from the older release tag. Accepted helper fixes therefore never executed until a full packaged release, despite the caller pinning the workflow commit.

Reproductions:

• https://github.com/Automattic/agents-api/actions/runs/29740719086
• https://github.com/Automattic/build-with-wordpress/actions/runs/29740702483

How to test

1. Run npm run test:agent-task-workflow-interface.
2. Run npm run test:agent-task-contracts.
3. Run actionlint .github/workflows/*.yml.
4. Confirm a consumer with matching full uses and wp_codebox_workflow_ref SHAs plus release tag wp_codebox_release_ref passes contract validation.
5. Confirm a consumer omitting wp_codebox_workflow_ref still checks helpers out from its release tag.

Compatibility

This is an additive reusable-workflow input. Existing consumers retain release-tag helper behavior. Consumers opting into an accepted helper commit can execute workflow fixes without changing packaged runtime assets.

Closes #1891

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with GPT-5.6-sol
• Used for: Diagnosed the hosted helper override and implemented the additive interface, validation, tests, and documentation with Chris reviewing and owning the change.