ci: test exact filecoin-services release candidates

[rjan90]

Summary

• add an optional exact filecoin_services_commit input to the existing manual nightly workflow
• run only stability-frontier-filecoin-services when that input is supplied
• validate a full lowercase 40-character SHA and override only filecoin-services
• preserve the stable PDP gitlink and all other stability selections
• document the pre-tag release-candidate flow and add focused resolver tests

Context

This is intentionally stacked on #154, which introduces the mixed dependency profiles and independent PDP resolution. It enables the filecoin-services v1.3.1 candidate to be tested at exact commit 4d8f21a96eceddf29619a606f57665ab1a0b9369 before the tag exists.

The candidate run must happen before creating v1.3.1: PDP stability is derived from the latest stable filecoin-services tag, so tagging first would change the old-PDP compatibility baseline.

Scheduled nightly behavior is unchanged. A normal manual dispatch without the new input still runs the full existing matrix.

Validation

• python3 -m unittest scripts.tests.test_resolve_ci_dependencies — 28 passed
• python3 -m unittest discover -s scripts/tests -p 'test_*.py' — 34 passed
• Black check passed for the modified Python files
• both modified workflow files parse as YAML
• git diff --check passed
• live resolver dry run selected:
  • filecoin-services: 4d8f21a96eceddf29619a606f57665ab1a0b9369
  • PDP: b8ae60d12490d9821c86781f37470037fcc4dc10 from filecoin-services v1.3.0
  • all other components: stability

The repository-wide local lint run passed formatting and all Python tests. Local Clippy reported two existing &PathBuf warnings in untouched Rust files; #154's current CI run is green for both lint and cargo tests.