fix(ci): scope beta advisory to live-provider suites and validate reuse targets

Codex review round two: the reusable advisory input is global, so beta
would also have softened hermetic repo/OpenShell E2E — add a scoped
live_advisory input that only covers the live-provider suite jobs and
narrow the umbrella fail-fast exclusion to those job names. Evidence
reuse now also runs the macOS source-version consistency check against
the target (release-preflight --macos-versions-only) so version-stamp
deltas cannot reuse evidence while version surfaces disagree.

scripts/github/find-reusable-release-validation.sh

@@ -17,6 +17,7 @@ MAX_CANDIDATES=12
 GITHUB_OUTPUT_FILE="${GITHUB_OUTPUT:-}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLASSIFIER="${SCRIPT_DIR}/../check-release-metadata-only.mjs"
+PREFLIGHT="${SCRIPT_DIR}/../release-preflight.mjs"
 
 usage() {
   cat >&2 <<'EOF'
@@ -126,6 +127,13 @@ if ! expected_inputs="$(jq -Sc . <<< "$INPUTS_JSON" 2>/dev/null)" || [[ -z "$exp
   exit 2
 fi
 
+# A metadata-only diff can still leave the target's version stamps mutually
+# inconsistent (for example package.json bumped without the macOS plist);
+# validate the target state before trusting any prior evidence.
+if ! (cd "$REPO_DIR" && node "$PREFLIGHT" --macos-versions-only >&2); then
+  no_reuse "target version metadata is inconsistent"
+fi
+
 runs_json=""
 if ! runs_json="$(
   gh api -X GET "repos/${REPO}/actions/workflows/${WORKFLOW_FILE}/runs" \