ci(release): bound history scan to release delta

[vkehfdl1]

Summary

• derive the release history scan from the merge-base of the previous version tag and the current tag
• preserve full scanning of every commit introduced since the prior release, even after rewritten release tags diverge from main
• add a synthetic regression for rewritten-tag ancestry

Root cause

The release workflow passed a single tag SHA to git rev-list, which scans every ancestor. After the privacy rewrite, historical release tags are no longer direct ancestors of current main, so validation reached pre-remediation .omo commits and blocked publishing.

Verification

• bash tests/verify_history_privacy.sh
• python3 scripts/verify_history_privacy.py . "$(git merge-base v0.3.0 HEAD)..HEAD"
• python3 scripts/verify_release_config.py