fix(ci): use fresh acceptance for current stable

[pallyoung]

What changed

• inspect the latest stable Desktop channel versions before choosing acceptance scenarios
• use fresh-native/fresh-wsl when the stable Shell and both Runtime versions already equal the candidate
• retain the full upgrade/fault matrix only when the stable release is genuinely older
• add workflow assertions for explicit repository download and version comparison

Root cause

After desktop-v0.1.1 became stable, rerunning acceptance for workflow-only changes treated that exact same 0.1.1 / 0.5.8 release as an older upgrade baseline. Runtime-only scenarios then carried forward the production-signed WSL Engine while validating against the ephemeral acceptance key, and same-version combined scenarios had no real upgrade boundary.

Impact

Workflow-only commits can produce fresh acceptance reports for the current product bytes without mixing production and ephemeral signing identities. Real future version upgrades still exercise the full installed-upgrade and fault matrix.

Validation

• workflow boundary test: 5/5 passed
• pnpm ci:typecheck: passed
• pnpm changeset:validate: passed
• git diff --check: passed