fix(release): validate compare target explicitly

[syzsunshine219]

Problem

The merged v1.0.7 release Action (run 32009739539) failed in Build complete release change snapshot. GitHub Compare REST responses do not contain a top-level head_commit, so reading .head_commit.sha always returned empty and triggered a false identity mismatch.

Fix

• Keep GitHub Compare validation for the exact base SHA, merge-base, status, ahead/behind counts, and total commit count.
• Validate the remote target SHA through GET /repos/{owner}/{repo}/commits/{TARGET_SHA}.
• Keep the local complete snapshot head_commit.sha validation against the trusted checkout.
• Upload TARGET_COMMIT_METADATA.json with the release audit artifact.
• Add a regression test that models the real Compare response shape without head_commit and prevents the invalid read from returning.

Verification

• Regression test observed failing before the workflow change.
• Release workflow tests: 20/20 passed.
• Actual v1.0.6 → failed v1.0.7 target comparison: 431 commits / 496 files, all base/merge-base/remote-target/local-target/count checks passed.
• Project Harness Full gate: 12/12 passed on 13bf60f3d97a16a5f9fd76e578d36b5564fa1660 against main@5fd094b1b8a04151d506cdbfc68b4b52b0cb42df.

Recovery after merge

Do not rerun the old failed event. After this PR is merged, manually dispatch GitHub Draft Release v2 from main with:

• version: 1.0.7
• preflight_level: full
• create_draft: true
• target_sha: leave empty

There is currently no v1.0.7 Tag or Release. This PR does not create, move, or publish either one. A different MemTensor maintainer must independently review and approve this T3 change.

[syzsunshine219]

Project Harness review handoff marker. Only reviews submitted strictly after this GitHub timestamp qualify.