Fix semver orchestration baseline fixture

[jcwal1516]

Summary

• refresh the synthetic semver baseline fixture from v0.7.3 to v0.7.5
• include j2k-ml in the synthetic published-package inventory
• keep release-tag Git operations inside the fake command boundary and assert the exact pinned commands

Root cause

The production 0.8 semver gate correctly moved to the published v0.7.5 baseline, but the command-orchestration fixture still mocked v0.7.3. On macOS, semver reaches the baseline-tag boundary; the shallow CI checkout has no tags, so the fake wrapper delegated git rev-parse v0.7.5^{commit} to the real repository and failed.

This caused both macOS test lanes in full-validation run 30413210849 to fail. The codec and all other direct validation lanes passed.

Impact

This is test-harness-only. It changes no codec behavior, public API, package metadata, or workflow policy. Future baseline drift now fails inside the hermetic fake boundary instead of depending on tags available in the host checkout.

Validation

• reproduced the exact failure with a temporary tagless Git repository before the patch
• tagless regression passed under pinned Rust 1.96
• tagless regression passed under stable Rust
• cargo test -p xtask
• cargo clippy -p xtask --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo xtask repo-lint
• git diff --check