confirm-main must settle on the release job by leaf name, not the first job containing 'release'

[wphillipmoore-vergil-user]

vrg-release's confirm-main settles on the wrong CD job once vergil-actions' cd-release gains package jobs (vergil-project/vergil-actions#905).

Problem

confirm_main waits with _settled_run_jobs(ctx, run_id, ("release",)) (src/vergil_tooling/lib/release/confirm.py:31). That uses _find_job (:133), which returns the first job whose name contains "release". Consumers call the reusable cd-release, so every job surfaces as release / <job>.

With #905, the reusable workflow adds release / package-matrix, which runs for every repo (with or without [package]) and finishes first, plus release / package-build / <cell> and release / package-sign. The wait can then end before release / release has a conclusion. _verify_release_job then sees an unfinished release job and fails the release falsely. This brings back the race fixed in #1611, fleet-wide, as soon as vergil-actions v2.1 ships #905.

Fix

Settle on the actual release job using the existing leaf-segment matcher _is_release_job (:174), which already handles both release / release (consumers) and cd / release (vergil-actions' own inline job), instead of the substring match. Keep _find_job's substring behavior wherever other callers rely on it (e.g. ("docs",) at :54), or give the settle step a predicate.

Acceptance

• A test with a job list where release / package-matrix (completed) comes before release / release (in progress): the settle step keeps waiting, then verifies release / release.
• Existing fix(release): confirm-main job verification races the reusable-workflow leaf conclusion #1611 / bug(release): confirm-main rejects vergil-actions' own release job (cd / release) #2001 behaviors stay green.

Sequencing (load-bearing)

This fix must be released in vergil-tooling before vergil-actions is released with #905. Otherwise any repo's vrg-release can fail confirm-main.