Verify PR is unreleased by merge commit SHA after gh search

`gh search prs` associates a PR with commits left in its history by
force-pushes, so a stale commit on master can still surface a PR whose
merge commit is already on the stable branch. Re-check each candidate's
merge commit SHA against the cherry-pick footer set before treating it
as a backport target.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hsbt

tool/release.rb

@@ -394,7 +394,12 @@ def scan_unreleased_pull_requests(ids)
     pulls = []
     ids.each do |id|
       pull = gh_client.pull_request("ruby/rubygems", id)
-      pulls << pull if pull.merged_at
+      next unless pull.merged_at
+      # `gh search prs` can associate a PR with commits left behind by
+      # force-pushes that no longer match the merged HEAD. Confirm the PR is
+      # actually unreleased by comparing its merge commit SHA directly.
+      next if @level == :patch && released_commit_shas.include?(pull.merge_commit_sha)
+      pulls << pull
     end
     pulls
   end