fix: keep release profiles on the build they pin

mame_hash_scraper --release rewrote the whole profile and dropped the
pin_frozen that mame0258 and mame0278 carry: libretro/mame HEAD is a
later release, so without it profile_sync compares their refs with code
the Recalbox build never had. A release profile now states it, from
built_by, and keeps the reason a reader wrote.

tests/test_hash_merge.py

@@ -478,6 +478,9 @@ class AReleaseProfileDescribesItsOwnRelease(unittest.TestCase):
                          ("a" * 40, "b" * 40))
         self.assertEqual(profile["cores"], ["mame0278"])
         self.assertEqual(profile["built_by"], ["recalbox"])
+        # libretro/mame HEAD is a later release: the profile is judged
+        # against the revision the platform builds.
+        self.assertIn("recalbox builds libretro/mame", profile["pin_frozen"])
         files = {f["name"]: f for f in profile["files"]}
         self.assertEqual(sorted(files), ["neogeo.zip", "newset.zip"])
         self.assertEqual(files["neogeo.zip"]["system"], "snk-neogeo-mvs")