[rjd15372]

Summary

Tool half (rollout step 1) of the two-hop release flow designed in
docs/superpowers/specs/2026-10-13-prerelease-project-release-flow-design.md.
The CI workflows (step 2) follow in a separate PR; until then CI keeps running
the single-hop sync release on merge, and the new commands are available for
manual and rehearsal use.

• release.yaml: entries may now be {tag: ..., source_commit: <sha>}
  mappings (percona_obs/release_record.py); string entries keep working
  everywhere, including PPG_RELEASE, update_version_lists.py and the
  obs-pr-cleanup tag reader.
• project release: records source_commit (last sync-main run with green
  sync jobs, via gh, or --source-commit), refreshes an open release id in
  place (tag absent locally and on the remote), and carries the staging qa:
  blocks into the release mirrors with macros rendered.
• sync prerelease <releases-project> --branch-from <profile> (hop 1):
  record check (staging paths, _shared/ link targets and inherited config
  layers identical between source_commit and synced main), pre-release
  meta from the mirrors with publish forced on, drain/green/freeze, copy,
  verify, restore, source_commit marker in the project descriptions.
• sync release <releases-project> --from <pre-release> (hop 2): no freeze,
  no git divergence check, marker must match the tagged entry, subprojects
  come from the mirror tree, copy via the shared release_copy.py.
• sync release without --from is unchanged in behaviour (refactored onto
  release_copy.py; the freeze sequence is now _run_frozen).
• list_qa_matrix.py skips :releases: projects when enumerating a
  production root so the nightly does not re-test frozen release snapshots.

Not in this PR / open

• Package-level qa: lanes (package.yaml, pg_stat_monitor/pg_tde) are not
  carried into the mirrors, so release QA on the pre-release skips them.
  Needs a design decision before step 2.
• Workflows: obs-pr-check populate job, obs-pr-cleanup single dispatch,
  obs-release rewrite, sync-main lock removal (spec §3).

Testing

614 tests, black, pyright 0 errors. No live OBS run yet (dev OBS offline);
the labs rehearsal is planned with step 2.