fix(security): close OTP and release integrity gaps

[GSTJ]

Summary

Closes the concurrent OTP replay race caught by the hosted test and makes mobile releases reject untrusted refs and mutable tooling.

Details

• Consumes an OTP with one parameterized PostgreSQL update. The email, code, and expiry predicates stay on the write, so only one racing request can change the row.
• Reissues and races 25 codes in the regression test. The old Prisma updateMany path reproducibly let both requests succeed once its connections were warm.
• Verifies that release tags are annotated semantic versions, point at the workflow commit, and belong to main history.
• Rejects a release when the tag version, generated notes, or committed changelog do not match.
• Pins every external Action to a full commit SHA, EAS CLI to 23.1.0, and installs Maestro 2.6.0 from a checksum-verified archive.
• Uses frozen dependency installs and the committed Expo fingerprint command.
• Routes secret-bearing build and submission jobs through the production environment.

Testing steps

1. Run:

   pnpm test
   pnpm typecheck
   pnpm lint
   pnpm format
   pnpm exec dotenv -e .env.test -- pnpm -F @pegada/nextjs build

   Each command should finish successfully.

2. Run packages/api/src/services/authentication-service.test.ts. Confirm every one of the 25 races returns one success and one rejection.

3. Run the release verifier against v1.6.2. Confirm the annotated tag is accepted.

4. Try a store submission from main, an off-main tag, and a lightweight tag. Confirm each is rejected.

5. Run .github/scripts/install-maestro.sh with Java 17. Confirm it installs Maestro 2.6.0 only after the archive checksum passes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.