fix(release): derive patch version from latest attested release

[kjgbot]

Problem

The default patch release path can select an already-published tag when source package versions lag synthetic release commits.

For merged PR #515 (2d32cfdd):

• main declared 0.10.56
• npm/GitHub latest was 0.10.68
• run 35570715349 resolved the trusted baseline as 0.10.56, bumped to 0.10.57, and failed with release tag v0.10.57 already exists without an exact verified recovery
• the same merged SHA published successfully only after manually dispatching custom_version=0.10.69: run 35571141842, release v0.10.69

Release commits intentionally are not pushed back to main, so a normal patch dispatch must derive its next version from the highest valid attested release, not only the source manifest/reachability shape.

Acceptance criteria

• A default package=all, version=patch dispatch from stale source 0.10.56 with valid attested releases through 0.10.68 deterministically selects 0.10.69.
• Existing collision and provenance guards remain fail-closed for untrusted/conflicting tags.
• Exact same-run retry/resume behavior remains intact.
• Add a release-tooling regression test for the stale-source/ahead-release case.