[brainrake]

Summary

• Reuse the existing resolve-git-sha action in staging and production binary publisher jobs.
• Write the resolved package SHA into nix_flake_version instead of GITHUB_SHA, matching the AMI workflow when GIT_SHA_FROM_FLAKE_INPUT is configured.
• Keep dispatching, runners, artifact paths, and release-version selection unchanged. This is separate from ci: fix pg_upgrade script publish #2603.

Validation

• git diff --check passes.
• Parsed workflow YAML and executed the existing resolver plus tarball creation for both jobs with no override, a configured override, and a missing input (six passing cases).
• Verified the revision stored inside each generated tarball.
• No AWS uploads or release workflows were run.

Scope

This fixes the configured package-SHA override only. Pinning a dispatched workflow to the exact parent revision across branch movement remains separate.

[github-actions]

Package version diff: none (aarch64-linux, x86_64-linux)