ci: bind TKE merge runs to the exact merged subject

[LeftHandCold]

Problem

TKE checkin runs are triggered by pull_request_target. actions/checkout without an explicit ref resolves the repository default branch, so a PR merged into 4.2-dev built and tested an unrelated main commit. Run 33447333340 requested merge commit 60fb48f but built commit-b23beee.

Fix

• Checkout github.event.pull_request.merge_commit_sha for the image build.
• Fail closed unless the checked-out full SHA equals the event SHA.
• Export the verified full SHA to Setup and BVT.
• Bind both CN resource fetches to that same SHA.
• Reject github.sha and github.ref_name in this workflow with regression contracts.

The merged commit is already part of the trusted base repository; no unmerged PR head is executed.

Validation

• actionlint v1.7.12 passed for all workflows.
• 12 Python tests passed.
• New negative tests reject a missing build ref and reintroduction of default-branch context.
• git diff --check passed.

[LeftHandCold]

Reviewed exact head cd6eb59aa44b1f3489f39170d935f0730beef7b2. No blocking findings.

I traced the complete subject-identity chain:

• the producer checks out pull_request.merge_commit_sha, verifies the resulting full SHA, and derives the image tag only from that verified checkout;
• setup and BVT consume the verified full SHA;
• both in-CN resource clones fetch that same immutable SHA into a synthetic ref and verify HEAD;
• the workflow no longer uses github.sha or github.ref_name as a MatrixOne subject.

The concrete failing case also lines up: run 33447333340 carried default-branch headSha=61816c74..., while merged PR matrixorigin/matrixone#27925 records merge_commit_sha=60fb48fd...; this patch selects the latter.

Validation at this head:

• GitHub workflow validation/actionlint: PASS
• subject contract tests: 3/3 PASS
• existing coverage-selection tests in the workflow: 9/9 PASS
• git diff --check: PASS

I also checked merge-method semantics: after a PR is merged, GitHub defines merge_commit_sha as the actual base-branch commit for merge, squash, and rebase merges, so this does not regress those normal merge modes.

[Ariznawlll]

复核 exact head cd6eb59aa44b1f3489f39170d935f0730beef7b2，未发现 blocking 问题。

已核对完整 subject identity 链路：镜像构建 checkout pull_request.merge_commit_sha 并校验实际完整 SHA；Setup、两个 CN 内资源 checkout 和 BVT 全部消费同一个已验证的 full_commit_id；workflow 不再使用 github.sha 或 github.ref_name 作为 MatrixOne subject。该字段在 PR 合并后也能正确覆盖 merge、squash 和 rebase 三种正常合并方式。

验证结果：新增 subject contract 3/3 PASS，原有 coverage-selection contract 9/9 PASS，YAML parse PASS，git diff --check PASS，exact-head workflow check PASS。未触发或重跑任何 TKE/CI 测试环境。