Complete Commons pin release integrity

[BradGroux]

Summary

The concurrent merged work in issue #9 added ADR-009 and two sanitized final-pin reviews. This follow-up completes issue #8 by:

• linking every displayed exact Commons SHA to the complete immutable commit URL
• narrowly allowlisting that approved public Commons release identifier in the existing publication-safety validator
• preserving the prior AI-Native v1.0.0 tag object and peeled product commit
• publishing the sanitized follow-up standards/specification review with both resolved findings

Verification

• scripts/validate-repository.sh
• Standards: GO, no findings
• Specification: PASS, no findings after the full-URL correction

Closes #8