ci: keep local plugin release scripts trusted

[MLittleprince]

Summary

• keep legacy local-plugin publisher build source refs separate from release automation scripts
• always run .github/scripts from the workflow revision, even when git_ref points at an older package source commit
• cover the trusted-script contract in MemOS release workflow tests

Why

Run 30809108630 selected Branch: main but also passed git_ref=5c8e2700..., so the job checked out older release scripts and beta package-only releases still called the Doc Agent draft endpoint. This keeps git_ref useful for package code while preventing old workflow scripts from controlling beta/latest release behavior.

Validation

• node --test .github/scripts/draft-local-plugin-release-notes.test.mjs
• node --test .github/scripts/prepare-memos-release.test.mjs
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/memos-local-plugin-publish.yml"); puts "workflow yaml ok"'
• git diff --check

No npm publish, tag, GitHub Release, workflow dispatch, 106 webhook, or docs PR was run.

[Memtensor-AI]

🤖 Open Code Review

Target: PR #2199
Task: e729a1a7d91aef79
Base: main
Head: fix/local-plugin-trusted-release-scripts

✅ OpenCodeReview: No comments generated. Looks good to me.

Generated by cloud-assistant via Open Code Review.

[Memtensor-AI]

✅ Automated Test Results: PASSED

All tests passed (1/1 executed). memos_github_open_source/smoke: 1/1. Duration: 2s

Branch: fix/local-plugin-trusted-release-scripts