fix(ci): refresh the stale ghcommon script pin across reusable workflows

[jdfalk]

Summary

Every reusable workflow that checks out this repo's own
.github/workflows/scripts falls back to a hardcoded SHA when the calling repo
has no .github/ghcommon-ref.txt:

ref="e04c222a0366d5801d3b02bb76519f19ba1fa440"

That commit is from 2026-03-28. Callers consume the workflows at @main, so
main's workflow logic has been invoking helper subcommands that the four-month-
old pinned script doesn't define:

##[error]Unknown command: rust-build

The rust-* subcommands were added in 767acd4 on 2026-05-27 — two months
after the pin. So Rust CI fails outright in every repo without the ref file.

Surfaced by falkcorp/cockroach-rollout-agent, whose Rust CI activated for the
first time during the TODO fan-out (its Cargo.lock changed). Verified locally
that the repo itself is fine — cargo clippy --all-targets -- -D warnings,
cargo build --release and cargo test all pass; the failure was purely this
version skew.

Change

All 11 occurrences across 6 workflows now point at current main:

Workflow	Pins
reusable-ci.yml	5
reusable-release.yml	3
reusable-advanced-cache.yml	1
reusable-maintenance.yml	1
reusable-security.yml	1
commit-override-handler.yml	1

The primary fallback now carries a comment explaining that it must be kept in
step with the workflows shipped beside it — a stale pin here means main
calls into scripts that predate it.

Worth considering separately: this fallback is inherently a footgun, since the
workflow and the scripts live in the same repo but are versioned independently.
Deriving the ref from the running workflow would remove the failure mode
entirely.

Testing

actionlint clean on all six changed workflows — no structural errors, and the
only output is pre-existing shellcheck warnings in untouched run: blocks.

🤖 Generated with Claude Code

https://claude.ai/code/session_013vU67T2LJDCbYTBs9ZFAf2