feat: add commit reachability checks to detect fork-network injection

Adds reachability verification using the GitHub compare API to catch
supply chain attacks where a SHA exists in the shared object store but
is not on the canonical repository's lineage.

Detection:
- check command: UNREACHABLE = validation failure (fail-closed)
- pin/upgrade commands: UNREACHABLE = warning only (defense-in-depth)
- API errors (rate limit, 500) = Unknown, warn but don't block

Tests model 4 real-world supply chain attacks:
- tj-actions/changed-files (CVE-2025-30066)
- reviewdog/action-setup (CVE-2025-30154)
- aquasecurity/trivy-action (CVE-2026-33634)
- Checkmarx KICS (TeamPCP lateral movement)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nodeselector