build(flake): lock the release toolchain at the release PR lookup fix

[systemfsoftware-maker]

Change

flake.lock now locks the pnpm-release-management input at fbf617135160fbde74c64835d21dd918d13538d7 (systemfsoftware/pnpm-release-management#49). It was at 1abf89a. I did it with the override-input form:

nix flake lock --override-input pnpm-release-management \
  github:systemfsoftware/pnpm-release-management/fbf617135160fbde74c64835d21dd918d13538d7

No other lock node moved. With the pnpm-release-management node deleted from both files, the old and new flake.lock are identical.

Why

At 1abf89a, the dev shell's release-tools look up the release PR by passing a bare branch name as the head filter. GitHub ignores that filter, so the tools take the first open PR in the repo. That is how Dependabot #128 got overwritten. #49 asks for owner:branch and accepts only a PR whose head ref is the release branch in this repo's owner. CI's release workflow already runs the tools from its own revision (pnpm-release-management#42). This commit gives the local tools the same fix, and the push to master starts the Release run.

Evidence (local, through nix develop)

$ nix build --no-link --print-out-paths .#workspace-tarballs
/nix/store/99hsix5qwm30fp5inmccrsq88nx909yr-comment-checker-tarballs-0
  claude-code-comment-checker-0.3.6.tgz  index.json
$ command -v github-release-management
/nix/store/ikrllich3h44y10wlbhvb6w1d1p7hh95-release-tools/bin/github-release-management
$ github-release-management plan --tarballs $T
plan-release: legacy release v0.3.6 (@systemfsoftware/claude-code-comment-checker@0.3.6), identity not recorded
plan-release: pending_intents=3 this_cycle=0 deferred=0 -> phase=version
exit=0
$ github-release-management tag --tarballs $T --dry-run
dry run: 0 tag(s)
exit=0
$ changeset-management check origin/master
changeset gate: no publishable package changed (1 member(s))
exit=0

The compiled github-release-management in the dev shell contains ${repo.owner}:${head} and owner.login.toLowerCase(), and no Array.head(pulls).

No changeset intent: the changeset gate reports no publishable package changed.

After merge

The Release run on master should conclude with phase version. It should open a new PR from changeset-release/master, or update the PR that already has that head, and leave every other open PR alone. No tag is created.

[kiro-systemf]

Conductor verification: changes only the pnpm-release-management node in flake.lock, moving it to main fbf6171 (#49 lookup fix in the devshell's release tools). 10/10 checks green on 4e90b01. It does not overlap with the release PR, which only deleted changesets.