refactor(git): reuse _git_sources_pinned_sha1 helper in fetch_from_repo

fetch_from_repo() carried its own copy of the pinned-SHA lookup from
memoized_git_ref_to_info(), with the same shell-interpolated jq program
(source/branch concatenated into the filter text). Replace it with the
shared _git_sources_pinned_sha1 helper added earlier in this branch,
which passes values through jq --arg, and validate the pinned SHA before
overriding fetched_revision so a malformed pin fails loudly instead of
silently — matching the branch path in git-ref2info.sh.

Pure code cleanup: removes the last duplicated jq-injection of this lookup.

Assisted-by: Claude:claude-opus-4.8

Author: iav

lib/functions/general/git.sh

@@ -252,9 +252,14 @@ function fetch_from_repo() {
 		esac
 	fi
 
-	if [[ -f "${SRC}"/config/sources/git_sources.json && $ref_type == "branch" ]]; then
-		cached_revision=$(jq --raw-output '.[] | select(.source == "'$url'" and .branch == "'$ref_name'") |.sha1' "${SRC}"/config/sources/git_sources.json)
-		[[ -z "${cached_revision}" ]] || fetched_revision=${cached_revision}
+	if [[ "${ref_type}" == "branch" ]]; then
+		declare cached_revision
+		cached_revision="$(_git_sources_pinned_sha1 "${url}" "${ref_name}")"
+		if [[ "${cached_revision}" =~ ^[0-9a-f]{40}$ ]]; then
+			fetched_revision="${cached_revision}"
+		elif [[ -n "${cached_revision}" ]]; then
+			exit_with_error "Invalid pinned SHA1 '${cached_revision}' for '${url}' '${ref_name}' in config/sources/git_sources.json"
+		fi
 	fi
 
 	if [[ "${do_checkout:-"yes"}" == "yes" ]]; then
@@ -279,8 +284,8 @@ function fetch_from_repo() {
 				while read -r key path; do
 					# key is like: submodule.libfoo.path
 					# extract "libfoo" from "submodule.libfoo.path"
-					local name=${key#submodule.}   # -> libfoo.path
-					name=${name%.path}             # -> libfoo
+					local name=${key#submodule.} # -> libfoo.path
+					name=${name%.path}           # -> libfoo
 
 					cd "${git_work_dir}" || exit