fix(release): accept authenticated source mismatch

[fishmingyu]

Summary

Keep the installed Wiki/MCP release smoke aligned with the source-authority error emitted for a stale repository checkout.

Changes

• accept the manifest-bound source mismatch as a valid fail-closed stale-snapshot rejection
• add a direct regression test for exit status 2 and the new diagnostic

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally
• Added new tests for the changes
• pytest -q test/test_release_artifacts.py --tb=short (14 passed)
• pre-commit run --files scripts/smoke_release_services.py test/test_release_artifacts.py

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• Any dependent changes have been merged and published

Root cause: the service correctly rejected the stale checkout with status 2 after #588, but the smoke harness recognized only the two legacy diagnostics.

Failure evidence: https://github.com/sysevol-ai/CodeNib/actions/runs/31746352844