fix(release): fail loud with clean checkout logs

[bkearns]

Summary

• configure Git's initial branch as main for release checkout subprocesses, eliminating the default-branch warning hint at its source
• remove the GHCR manifest inspection fallback so an inspection error fails the release workflow
• add a contract test preventing either regression

TDD evidence

• RED: raw candidate run 33138419913 emitted suppress this warning from all five checkout jobs and contained a non-fatal manifest-inspect fallback
• GREEN: isolated checkout-style Git init creates HEAD=main without the hint; manifest inspect is the fail-loud final command

Verification

• independent verifier: PASS
• python3 -m unittest tests.ci.test_release_workflow
• actionlint .github/workflows/release.yml
• bash .github/scripts/check-actions-pinned.sh
• git diff --check