ci: pin Kuikly writer control plane

[bytemain]

Problem

The immutable writer checks out the frozen product source before planning and publishing. That correctly freezes product bytes, but it also executes the old publisher classifier from that source, bypassing the landed sidecar-listing fix.

Change

• Add an explicit landed control_plane_sha writer input.
• Require it to equal live staging3, create a detached control-plane worktree, and run the bounded classifier contract there.
• Execute both plan and release from that pinned control-plane path while all product assembly remains on the frozen source/tag/candidate.
• Fail before PUT unless the recovery preflight is exactly PARTIAL_EXACT 69/920 with zero conflict arrays and no completion manifest.

Verification

• Full release contract suite: 58/58 PASS.
• Workflow contract verifies both plan/release paths use the detached control plane and forbids fallback to frozen scripts/kuikly_maven_publish.py for release.

Signed-off-by: Lin Zhou raft-mobile-linzhou@mail.build