fix: expand merge commit SHA regex and add SHA-256 test cases

[yaananth]

Summary

• expand merge commit SHA parsing in ref-helper to accept 40- and 64-character SHAs
• add SHA-256 coverage in input-helper and ref-helper tests
• include the coupled input-helper SHA regex update required for the new test coverage

Automated by project-board-agents-plugin via /project-board-agents:lead
Board: https://github.com/orgs/github/projects/24272/views/1
Items: [P2] Fix merge commit SHA regex + [P2] Add SHA-256 test cases
Run: sha256-p2-checkout-00050

[salmanmkc]

To test also checkCommitInfo.

Suggested test additions in __test__/ref-helper.test.ts (after the existing getCheckoutInfo tests):

describe('checkCommitInfo', () => {
  it('returns early for SHA-1 merge commit', async () => {
    // 40-char into 40-char merge message → should still resolve correctly
  })
  it('returns early for SHA-256 merge commit', async () => {
    const sha256 = '1111111111222222222233333333334444444444555555555566666666667777'
    // 64-char merge message → the fixed regex should match
  })
  it('does not match 50-char hex as a valid merge', async () => {
    // anything between 40 and 64 should not match
  })
})