Release tracking (pin tracked upstream repos per bake)

Adds release tracking to pin specific upstream repo commits at bake time, enabling reproducible builds.