Expose the oid of the commit, so a caller can name what it just committed

[barnumbirr]

commit-branch.sh already parsed the oid out of the GraphQL response and threw
it away after logging its first twelve characters. It now reaches the caller as
a step output, and action.yml declares it.

Why

A caller that has to act on the commit could previously only ask GitHub to
resolve the branch again by name, and GitHub can still resolve a branch to its
previous tip for seconds after the mutation lands.

pkghaus/packages dispatched a release that way on 2026-09-13. The run checked
out the parent of the commit it was meant to release, read the pre-bump
changelog, derived a tag that already existed, planned nothing and went green.
The archive served the previous version of ouch for twelve hours.

Behaviour

• sha is the full oid, not the truncated form the log prints.
• Empty when nothing was committed, which is distinct from a failure: a failure
  exits non-zero and emits nothing, because the assignment that captures the oid
  takes the parser's exit status.
• An unset GITHUB_OUTPUT is a no-op, so local runs and the test suite are
  unaffected.

Blast radius

Additive. pkghaus/apt and pkghaus/brand consume this action and neither
reads the new output, so both are unaffected by the change itself.

Moving the v1 tag onto this commit is what arms it, and pkghaus/packages
depends on that tag having moved. Merge and retag here BEFORE merging the
matching change in pkghaus/packages, or that repo's bump will refuse to
dispatch a release.

Tests

tests/run.sh goes from 8 assertions to 13. tests/lint-action.sh gains an
assertion that every declared output reads from the step's id, since an output
wired to nothing resolves to the empty string forever and looks exactly like a
commit that changed nothing.

Mutation-checked: emitting the truncated oid, dropping the empty-sha report on
an unchanged tree, and dropping the signature check are each caught by the
suite.