docs: pin DTVM by commit in the campaign table, not by branch

The revmc entry in the same document argues that a branch pin stops being
reproducible the moment the branch moves, and then the DTVM row named a branch.
`03b542e` is the tree the measured library was actually built from, and it is
now pushed to the fork, so the reader can reach it.

Also names what that commit carries beyond the cache branch: the module-cache
bound of §5, and the two engine fixes that went upstream as DTVMStack/DTVM#605
and paradigmxyz#604.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018osheVEXr1SywFtbYFjHAc

Author: abmcar

docs/witness-replay.md

@@ -429,12 +429,20 @@ engines across *different* block sets — see §10.3.
 
 | Engine | Binary | Version pin | Notes |
 |---|---|---|---|
-| DTVM | `replay-batch` | `abmcar/DTVM@feat/evm-persistent-code-cache` | `RETH_SUBJECT_BACKEND=dtvm-eager`; needs `DTVM_EVM_MAX_MODULE_CACHE_SIZE=16384` (§5) and a metrics-OFF build for `--production-timing` |
+| DTVM | `replay-batch` | `abmcar/DTVM@03b542e6b765685795dee2d4a8a3efcba91d0e2a` | `RETH_SUBJECT_BACKEND=dtvm-eager`; needs `DTVM_EVM_MAX_MODULE_CACHE_SIZE=16384` (§5) and a metrics-OFF build for `--production-timing` |
 | evmone | `replay-block` | `DTVMStack/evmone` v0.18.0, sha256 `1316fad3aac3ee21…` | `RETH_SUBJECT_BACKEND=evmone-advanced`; no batch path (§6) |
 | geth | `geth-witness-replay` | go-ethereum v1.17.4 `36a7dc72e`, **fork** variant | §9 |
 | revmc | `revmc-witness-adapter` | `abmcar/revmc@42d475f`, `--lane resident` | §8; its own reth baseline |
 | REVM | — | in-record | `phaseWallTimeNs.rethRevmExecute`, from the same DTVM/evmone records (§3) |
 
+Give DTVM its commit, not its branch name. `03b542e` is the head of
+`feat/evm-persistent-code-cache` at the time of writing and is the tree the
+measured library was built from; it carries the persistent code cache, the
+module-cache bound of §5, and two engine fixes that landed upstream as
+DTVMStack/DTVM#605 (gas on an exceptional halt) and #604 (a null dereference
+misreported as an EVM memory fault). The branch keeps moving; the commit does
+not — the same reason §8 pins revmc by sha.
+
 Two of these run against a different host baseline than the others: revmc (and
 its native-REVM reference leg) is built on upstream reth v2.5.0-dev / revm 42,
 while the EVMC legs use this repository at v2.4.1 / revm 41. §8 explains why