fix(release): persist password manager image ref

[simonjcarr]

Summary

• resolve PASSWORD_MANAGER_API_IMAGE_REF inside the release verify step so set -u cannot see it as unbound
• add a dedicated regression script for the release workflow
• run that regression in Customer bundle check so PR CI catches the scope bug before another release run

Validation

• bash deploy/scripts/test-agent-release-password-manager-image-ref.sh
• git diff --check
• python3 workflow whitespace sanity check for .github/workflows/agent-release.yml and .github/workflows/customer-bundle-check.yml