ci: keep Base checkout inside release BOM workspace boundary #2497

The ecosystem release BOM currently checks out Base at the workflow root and exposes it to base-demo's example workspace manifest via a symlink at .dependencies/base. Base's workspace boundary intentionally rejects that symlink because it resolves outside .dependencies, so the macOS released base-demo walkthrough fails on the required base entry even though the Base checkout is present.\n\nUse an in-workspace Git worktree at .dependencies/base, tied to the already checked-out immutable Base commit, and add a regression assertion. The BOM must remain green on Ubuntu and macOS before Base 1.10.0 publication.\n\n## Acceptance criteria\n- .dependencies/base is an in-boundary Git worktree at the exact Base release candidate commit.\n- The released base-demo workspace status/onboarding path sees base as present and does not weaken the workspace symlink boundary.\n- Workflow contract tests cover the worktree setup.\n- The immutable release BOM passes on both Ubuntu and macOS.\n\nLabels: ci, bug; milestone: 1.10.0 release blocker.