Add checkout_ref input to CLI release prod workflow

Mirrors the existing input on freebuff-release.yml so prod releases
can be built from a specific commit while still bumping version on
latest main. Used to roll back to a known-good commit when main is
broken.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jahooma

.github/workflows/cli-release-prod.yml

@@ -12,6 +12,11 @@ on:
           - patch
           - minor
           - major
+      checkout_ref:
+        description: 'Git ref to build from (commit SHA, branch, or tag). Defaults to latest main.'
+        required: false
+        default: ''
+        type: string
 
 concurrency:
   group: cli-prod-release
@@ -80,7 +85,7 @@ jobs:
       binary-name: codebuff
       new-version: ${{ needs.prepare-and-commit-prod.outputs.new_version }}
       artifact-name: updated-package
-      checkout-ref: ${{ github.sha }}
+      checkout-ref: ${{ inputs.checkout_ref || github.sha }}
       env-overrides: '{"NEXT_PUBLIC_CB_ENVIRONMENT": "prod"}'
     secrets: inherit