fix(ci): pin whatsmeow-lib SHA from dev repo in sync-releases

The sync workflow was re-cloning whatsmeow main on every sync, which
meant the SHA fixed on develop (and cited in CHANGELOG) was not
propagated to evolution-go / evolution-go-beta. This broke release
reproducibility: a public build of vX.Y.Z could differ from the
equivalent dev snapshot whenever whatsmeow main moved.

Capture the dev-side submodule SHA before touching the target repo,
then run submodule add + checkout that exact commit in the target.

Addresses checklist item #5 of tools/docs/RELEASE_PROCESS.md
(whatsmeow-lib está no commit correto).

Author: DavidsonGomes

.github/workflows/sync-releases.yml

@@ -112,14 +112,16 @@ jobs:
 
       - name: Setup whatsmeow-lib
         run: |
+          WHATSMEOW_SHA=$(cd ${{ github.workspace }}/whatsmeow-lib && git rev-parse HEAD)
+          echo "Pinning whatsmeow-lib to $WHATSMEOW_SHA (from dev repo)"
           cd ${{ steps.target.outputs.dir }}
           git rm -rf whatsmeow-lib 2>/dev/null || true
           rm -rf whatsmeow-lib .gitmodules
-          printf '[submodule "whatsmeow-lib"]\n\tpath = whatsmeow-lib\n\turl = https://github.com/EvolutionAPI/whatsmeow.git\n' > .gitmodules
-          git add .gitmodules
-          git clone https://github.com/EvolutionAPI/whatsmeow.git whatsmeow-lib
-          git submodule init
-          git submodule update
+          git submodule add -f https://github.com/EvolutionAPI/whatsmeow.git whatsmeow-lib
+          cd whatsmeow-lib
+          git checkout "$WHATSMEOW_SHA"
+          cd ..
+          git add .gitmodules whatsmeow-lib
 
       - name: Clean artifacts
         run: |