ci: enable immutable prerelease publication

[Obed0101]

Problem

The prerelease workflow is present on dev but absent from the default main branch, so GitHub cannot dispatch the beta workflow. This currently prevents publishing the already-merged beta candidate from its exact dev commit.

Solution

Promote only the release workflow changes needed by the prerelease path:

• add the prerelease.yml dispatcher to the default branch;
• add source_sha and reusable-workflow support to release.yml;
• build and attest the exact candidate commit;
• allow prerelease publication from a candidate that is an ancestor of dev, while keeping stable publication restricted to main.

No product source, version, changelog, or local worktree files are included.

Evidence

• YAML parsing passed for both workflows.
• git diff --check passed.
• Staged scope was exactly .github/workflows/prerelease.yml and .github/workflows/release.yml.
• The target beta candidate is already merged in dev at 4e3b991a8e14165cce39884cc3034b5e8ff19a0a via PR fix: make repeated Esc cancellation terminal #327.

Follow-up

After this PR merges, dispatch Prerelease candidate with channel=beta, beta_number=5, and dry_run=false. The release workflow will build from the immutable candidate SHA and create the draft prerelease for final artifact verification.