M11.5b: support historical release re-audit

[pgousdal]

Fix manual post-release re-audits of immutable historical releases without weakening the release gate.

Changes:

• keep verify-release-ref.sh strict by default (tag -> exact commit and HEAD == expected commit)
• add one explicit --allow-head-mismatch-for-audit mode that preserves SemVer and tag -> commit binding but permits the audit workflow itself to run from newer main
• use that mode only for workflow_dispatch historical audits
• keep automatic workflow_run audits on strict mode
• add CI coverage proving strict mode still rejects historical HEAD mismatch, audit mode accepts only the intended mismatch, and unknown modes fail closed

This addresses Post-release audit #2 for the already-published immutable v0.2.0 release.