docker-publish: freeze the unsloth-zoo ref to a concrete sha before fan-out

The zoo_ref prepare step emitted the bare branch name (main) on the normal
push/schedule path, and both arch matrix legs plus the Studio build pass that
to pip install unsloth-zoo @ git+...@REF. If unsloth-zoo advanced mid-build a
single multi-arch tag could bake different zoo code across architectures or
between the base and Studio venvs. Resolve a branch/tag to its current sha via
ls-remote here (mirroring the notebooks step), so the whole matrix pins one
immutable commit. A 40-char sha input stays frozen; a lookup miss falls back to
the bare ref so the build can still fetch by name.

.github/workflows/docker-publish.yml

@@ -126,8 +126,20 @@ jobs:
                   REF="${{ github.ref_name }}"
               fi
           fi
-          echo "ref=${REF:-main}" >> "$GITHUB_OUTPUT"
-          echo "unsloth-zoo ref: ${REF:-main}"
+          REF="${REF:-main}"
+          # Freeze a branch/tag ref to ONE concrete sha before the matrix fans
+          # out, so both arch legs (and the base vs Studio builds) bake the
+          # identical unsloth-zoo even if main advances mid-build. A 40-char sha
+          # is already frozen; resolve anything else via ls-remote, as the
+          # notebooks step does, falling back to the bare ref on a lookup miss.
+          if printf '%s' "$REF" | grep -Eq '^[0-9a-f]{40}$'; then
+              SHA="$REF"
+          else
+              SHA="$(git ls-remote https://github.com/unslothai/unsloth-zoo "$REF" | awk 'NR==1{print $1}')"
+              [ -n "$SHA" ] || SHA="$REF"
+          fi
+          echo "ref=${SHA}" >> "$GITHUB_OUTPUT"
+          echo "unsloth-zoo ref: ${SHA}"
 
       # Freeze unslothai/notebooks to ONE concrete commit so both arch legs (and
       # release reruns) bake the identical baked-notebook templates and