fix(studio-pack): run the oracle studio-pack.sh from inside its worktree

[vjan-nie]

Fixes the first studio-pack dispatch, which failed:
https://github.com/Univers42/graph_render/actions/runs/37690199241.
It failed at "Byte-identical to the commit's own studio-pack.sh", exit 2:

cp: cannot stat '/home/runner/work/_temp/upstream/target/wasm32-unknown-unknown/release/graph_wasm.wasm': No such file or directory

Nothing was pushed. The tag check, the two Dockerfile builds and their comparison all passed; Push was skipped.

Root cause

• scripts/orch/gr:8 decides what to mount at /w with top=$(git rev-parse --show-toplevel), so it uses the git top-level of the current directory (gr:21, -v "$top:/w").
• scripts/studio.sh:23 instead resolves root from the script's directory.
• The step ran from $GITHUB_WORKSPACE, the main checkout. So cargo compiled main's tree into the checkout's target/, and studio.sh then looked for the wasm in the 77b68d9 worktree's empty target/.
• In the PR ci(studio-pack): publish the studio pack as a pinned OCI image #1 evidence I ran the script from inside the worktree, which is why it passed locally.

Fix (one line)

cd "$RUNNER_TEMP/upstream" && scripts/studio-pack.sh target/pack

Evidence (local, step body extracted verbatim from the workflow, run with bash --noprofile --norc -eo pipefail from the main checkout)

	Result
Negative control (step as on main)	exit 2. cp: cannot stat '…/upstream/target/wasm32-unknown-unknown/release/graph_wasm.wasm'. The wasm landed in the main checkout's target/
Fixed step	exit 0, including its final diff -r against the Dockerfile pack. Upstream tarball sha256 44f8f241…c024, the same as the PR #1 evidence. The main checkout has no target/
actionlint 1.7.7	exit 0

Merge policy: merge commit (--merge), branch deleted after merge.