fix: make release reruns use workflow-owned helpers

[resoltico]

Summary

• make workflow-dispatch release reruns resolve repo-owned helper scripts from main while keeping the immutable tag checkout for product payloads
• update the release-surface regression owners to assert the replay-safe helper-root contract instead of stale literal paths
• document the publication replay repair in the changelog

Verification

• bash ./scripts/test-verify-release-candidate-tag.sh
• bash ./scripts/test-setup-msvc-dev-cmd.sh
• bash ./scripts/test-verify-github-release.sh
• ./check.sh --console=plain