updateReleaseRevision validates SHA

Trap: updateReleaseRevision() can trust its caller because the existing canonical link was validated, but an arbitrary replacement corrupts release authority. Fix: require exactly 40 lowercase hex characters and replace only parser-recorded SHA offsets. Regression-test strict byte-for-byte preservation outside those offsets, including CRLF, trailing newlines, and appended decoy text.