fix: read a tagged upstream at its tag only

detect_pinned_tag matched core_version against every view, so an upstream_commit set to the release tag a port was cut from (triforce on Dolphin 2407, dosbox_pure on 1.0-preview7, GroovyMAME on mame0289) froze the whole profile: the port was no longer compared with its HEAD and bump_commit refused. Only the documented build's repository freezes the profile now. An upstream on its tag is self-checked at that tag, is not reported orphaned, and a bump leaves upstream_commit on it.

wiki/profiling.md

@@ -301,7 +301,10 @@ only hold at one revision, so a few rules keep them checkable.
   it.
 - **A frozen line is pinned to its tag.** A profile documenting a release that
   lives as a tag in a still active repository (`pcsx2-legacy` at PCSX2 v1.6.0)
-  is checked against its own revision and never rebased onto the head.
+  is checked against its own revision and never rebased onto the head. An
+  `upstream` whose pin is the tag `core_version` names (GroovyMAME's base,
+  `mame0289`) is read at that tag the same way, while the port itself is still
+  compared with its head, and a bump leaves `upstream_commit` on the tag.
 - **A fork's base comes from the forge.** `upstream_commit` of a fork is the
   merge base the compare API returns. A vendored `version.h` can name the
   project the fork once came from. When a package ships prebuilt binaries