fix(relay-ops): bind the canary cell's admission class into same-cap batch authority (#21313)

A batch-apply wave verified only that the sealed canary named some approved
same-cap cell, so a canary rolled on the migration-only, zero-host, 600-cap
c17 or c18 was accepted as authority for a general 1000/3000-cap batch. The
verify step now hands the batch's own cells to the check, which requires the
sealed cell's entry admission to equal the batch's class.

.github/workflows/cloud-deploy-relay-production-same-cap.yml

@@ -181,14 +181,20 @@ jobs:
         if: ${{ inputs.mode == 'batch-apply' }}
         env:
           CANARY_RUN_ID: ${{ inputs.canary-run-id }}
+          CELL_IDS: ${{ inputs.cell-ids }}
+          TARGET_DIGEST: ${{ inputs.target-image-digest }}
+          ROLLBACK_DIGEST: ${{ inputs.rollback-image-digest }}
+          SELECTOR_GENERATION: ${{ inputs.expected-selector-generation }}
+          REHOME_GENERATION: ${{ inputs.expected-rehome-generation }}
         run: |
           node dev/scripts/relay-production-same-cap-wave.mjs verify-canary \
             --file "${RUNNER_TEMP}/relay-same-cap-canary/authority.json" \
             --commit-sha "${GITHUB_SHA}" --run-id "${CANARY_RUN_ID}" \
-            --target-digest "${{ inputs.target-image-digest }}" \
-            --rollback-digest "${{ inputs.rollback-image-digest }}" \
-            --selector-generation "${{ inputs.expected-selector-generation }}" \
-            --rehome-generation "${{ inputs.expected-rehome-generation }}"
+            --cell-ids "${CELL_IDS}" \
+            --target-digest "${TARGET_DIGEST}" \
+            --rollback-digest "${ROLLBACK_DIGEST}" \
+            --selector-generation "${SELECTOR_GENERATION}" \
+            --rehome-generation "${REHOME_GENERATION}"
 
       - name: Reject previously consumed aggregate safety evidence
         if: ${{ inputs.mode != 'verify' && inputs.gate-override-confirmation == '' }}