Pin upstream clone SHA in lint.yml + log it for fidelity reproducibility

[patrick-chinchill]

Problem

.github/workflows/lint.yml clones vercel/chat at the chat@4.26.0 tag, but tags can (in theory) be moved. If upstream re-tags or force-pushes, our "fidelity against chat@4.26.0" claim silently drifts without any commit in this repo.

Proposed work

1. Resolve the tag to a concrete commit SHA (git rev-parse chat@4.26.0 inside the upstream checkout) and pin that SHA in lint.yml.
2. Log the resolved SHA in the workflow output so it's visible in every CI run — e.g. git rev-parse HEAD after the clone.
3. Optionally: add a pre-flight check in scripts/verify_test_fidelity.py that verifies the upstream HEAD matches an expected SHA (fail loudly if not).
4. Document the pinning convention in docs/UPSTREAM_SYNC.md alongside the UPSTREAM_PARITY constant.

Related

• PR ci(fidelity): ratchet-down baseline + wire into lint.yml #72 — initial fidelity strictness work
• Low-severity finding from local adversarial review, deferred as its own issue