fix(release): deploy the exact appcast commit

[hcaiano]

Summary

• add an optional exact checkout_ref to the website deploy workflow
• expose the appcast commit SHA from the release workflow
• dispatch deployment with that exact SHA to avoid stale main resolution

Test plan

• swift build
• swift run cycler-tests (ok — 106 checks passed)
• actionlint .github/workflows/release.yml .github/workflows/deploy-web.yml
• git diff --check

Runtime evidence

• release run 29111516859 correctly committed appcast fdde243, but its immediate deploy dispatch resolved main to the preceding 72f2ab7 commit; manual deploy 29111743138 from fdde243 published the correct feed