fix(ci): resolve the upstream pin to a BSR commit id

[josephschorr]

Fixes the failure of the first fully-automatic run (33778594627), where all seven proto clients failed identically:

Failure: resource with name "authzed/api:3fe8742a11c2a3e06b902d9dfe412043ef80f652" was not found
Error: proto generation failed for: go, python, typescript, csharp, java, ruby, rust

Cause

The main path pinned to the api git commit SHA, on the assumption that buf-action labels every commit with its SHA. It doesn't — it labels by branch and by tag.

Verified against the live registry:

Ref	Git commit in api?	BSR label?
3fe8742… (the merge that triggered this)	✅	❌
7144bbf4ecce…	✅	✅
50996d88f11f…	❌ not even a git object	✅

Recent labels are all branch names — main, clients-prototype-regen, materialize-stats-service — plus version tags. The SHA-shaped labels that made the original assumption look correct are historical artifacts.

The failure was at least loud: buf exited 1 rather than silently generating from a stale main, which is what the pinning design was for. Everything else in the chain worked — dispatch, authorize, BUFTAG plumbing, partial-failure handling, Slack, and the job going red.

Fix

The BSR does know the git commit — as a commit's source_control_url rather than as a label. So resolve it explicitly, then pin generation to the resulting immutable BSR commit id.

That's stronger than the original intent. A commit id cannot move, so all seven clients generate from exactly one revision even if another api merge lands mid-run — something a main label could not guarantee.

Verified against the live registry for every input shape the workflow can receive:

3fe8742a11c2...  (git SHA — the one that failed)  -> 2361586d43254e82...
main             (branch label)                   -> 2361586d43254e82...
v1.53.0          (version tag)                    -> 55aa23d533a34fa8...
2361586d4325...  (already a commit id)            -> 2361586d43254e82...
deadbeef...      (garbage)                        -> fails loudly

PR titles and branch names keep the human-readable ref, so regen/api-main stays regen/api-main. The PR body now records both the original ref and the resolved commit, and the reproduce line uses the commit id so a local run reproduces the exact revision.

🤖 Generated with Claude Code