[DevTools] Use one commit for extension release inputs (#37307)

## Summary

`build-and-test.js` could feed three different commits into one release:
`git archive main` (not `HEAD`), an interactively chosen React CI build,
and `HEAD` saved as metadata. Firefox source review then could not
reproduce the zip.

Require a clean tree, resolve `HEAD` once, and use that hash for the
source archive, the experimental React download, and the metadata
printed for AMO. Drop the prompt that let those diverge.

Depends on #37305 and #37306.

## How did you test this change?

Build-script only. The release helper now errors on a dirty tree and
threads a single `git rev-parse HEAD` into archive, download, and
metadata.

Co-authored-by: Ruslan Lesiutin <hoxy@meta.com>