chore(release): add yarn release:refs helper to list release refs

Since workflow_dispatch dropdowns can't be populated from git history, this
prints recent release (version) commits so a maintainer can copy a real release
ref to nominate for the release workflow's `ref` input, annotating each with the
@cardano-sdk/core version it carries as a quick anchor to confirm a ref's
versions before nominating it.

Implemented as release-refs.mjs (matching collectCoverage.mjs): invokes git via
execFileSync (no shell — portable, no quoting pitfalls), and filters on the
commit subject (stable + rc) with an authoritative regex in JS, so reverts and
merge commits that merely mention the subject in their body don't leak in
(`--grep` is only a coarse pre-filter, since it matches the whole message).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rhyslbw

package.json

@@ -36,6 +36,7 @@
     "version:stable": "lerna version --conventional-graduate --allow-branch master --create-release github -m \"ci: publish packages [skip actions]\" --sign-git-commit",
     "publish:rc": "lerna publish from-package --dist-tag rc --yes",
     "publish:stable": "lerna publish from-package --yes",
+    "release:refs": "node release-refs.mjs",
     "test": "yarn workspaces foreach -v run test",
     "test:build:verify": "yarn workspaces foreach -v run test:build:verify",
     "test:e2e": "yarn workspaces foreach -v run test:e2e",

release-refs.mjs

@@ -0,0 +1,37 @@
+// Lists recent release (version) commits with the @cardano-sdk/core version each carries,
+// so a maintainer can nominate a real release ref (and its versions) for the `release`
+// workflow's `ref` input. workflow_dispatch dropdowns can't be populated from git history,
+// so this is the discovery aid. See .github/workflows/release.yaml.
+import { execFileSync } from 'node:child_process';
+
+// Invoke git directly (no shell) — portable and free of quoting pitfalls.
+const git = (...args) => execFileSync('git', args, { encoding: 'utf8' });
+
+// Authoritative match is on the commit SUBJECT (stable + rc). `git log --grep` matches the
+// whole message (subject + body), so it's only a coarse pre-filter to keep the walk cheap;
+// this regex then drops anything (reverts, merges) that merely mentions the subject in its body.
+const SUBJECT_RE = /^ci: publish (rc )?packages \[skip actions\]$/;
+const limit = Number.parseInt(process.argv[2], 10) || 20;
+const US = '\x1f'; // unit separator — a field delimiter that can't appear in the log fields
+
+const rows = git('log', '-F', '--grep=ci: publish', `--format=%h${US}%H${US}%ci${US}%s`, '-n', String(limit * 3))
+  .split('\n')
+  .filter(Boolean)
+  .map((line) => line.split(US))
+  .filter(([, , , subject]) => SUBJECT_RE.test(subject))
+  .slice(0, limit);
+
+if (rows.length === 0) {
+  console.log('No release commits found.');
+  process.exit(0);
+}
+
+for (const [short, full, date] of rows) {
+  let version = '?';
+  try {
+    version = JSON.parse(git('show', `${full}:packages/core/package.json`)).version;
+  } catch {
+    // packages/core/package.json may not exist at very old commits — leave as '?'
+  }
+  console.log(`${short}  core@${version.padEnd(11)}${date}`);
+}