Bind Action evaluation to the workflow PR head SHA

[daichunghy]

Description

This binds the Action's authenticated snapshot to the exact pull_request.head.sha that triggered the workflow and makes the selected commit visible in the Check Run output.

The change follows the technical feedback in Discussion #29.

Linked Issues

• Discussion A green check from the wrong commit is still the wrong evidence #29 — external feedback source; no issue is closed by this PR.

Changes Classification

• Bug fix (non-breaking change fixing an issue)
• Security hardening / refactor
• Documentation update

Review-Readiness Checklist

• Verified locally with npm run verify (lint, types, unit tests, security tests, fixtures, CLI smoke).
• No any types introduced in production code.
• Pure evaluator invariants preserved (no I/O, no wall clocks in core).
• Tested against relevant fixtures and added regression coverage for event/live head mismatch and Check Run binding.
• Changes do not execute untrusted code in privileged GitHub Action contexts.

What changed

• Adds an optional event-bound expectedHeadSha assertion to the GitHub identity request.
• Rejects GITHUB_TARGET_CHANGED before evaluation when the live PR head has advanced past the workflow event.
• Shows full testedSha, headSha, baseSha, target kind and binding state in the summary and Check Run text.
• Exposes target-kind, tested-sha and head-sha Action outputs.
• Refuses Check Run delivery if its head_sha differs from the receipt's testedSha.
• Documents the current QAOnFire boundary: its public App metadata has no checks:write, so its PR comment is context, not required-check evidence.

Evidence

• npm run verify — pass: 110 main tests, 14 security tests, 33 GitHub integration tests, 6 CLI smoke tests, clean-room bundle and consumer fixture.

Boundary

This PR does not claim an external QAOnFire installation or end-to-end success. QAOnFire's current public App permissions do not expose a Check Run path; an authorized maintainer run is still required to validate the workflow in their repository.