When testVersions is enabled, the version matrix check now identifies
the specific commit that modified ci/pinned.json, rather than evaluating
the full PR. This allows formatting changes and other modifications to
coexist in the same PR without affecting the hash consistency check.
The workflow now:
- Adds headSha input to compare PR commits against target
- Finds the single commit that touched ci/pinned.json
- Errors if multiple commits modify it (to ensure clear attribution)
- Passes the bump commit to the checkout action for isolated evaluation
- Reports which commit was evaluated in the summary
The actual cherry-pick and pinned checkout handling is delegated to
the checkout action via the new `untrusted-pin-bump` input.
Co-Authored-By: Matt Sturgeon <matt@sturgeon.me.uk>
