Build macdoc releases from isolated source snapshots

[kiki830621]

Refs #163

Summary

• materialize a fresh detached worktree from the clean captured source commit
• run the release build in that isolated tree with a fresh .build
• reject isolated-tree HEAD or file drift before codesign
• pin release target and notes to the captured commit
• cover source drift, HEAD drift, concurrent primary edits, and clean success

Verification

• source-stability harness passed
• ShellCheck, Bash syntax, and diff checks passed
• cross-repo requirements/logic/security/Devil’s Advocate verification passed

Related rollout

• bug: refuse release when source tree changes during build che-word-mcp#195
• bug: refuse release when source tree changes during build che-pdf-mcp#4
• bug: refuse release when source tree changes during build che-pptx-mcp#2

No automatic GitHub closing trailer is included. After merge, use the explicit IDD closing workflow for issue 163.