Bake GIT_COMMIT_SHA into runner image

[sparrowDom]

Bakes the build commit into the runner image so @talos/client's runContainer reports it as the runner's version (it reads GIT_COMMIT_SHA). This populates runners.version in the shared Talos Postgres — null today — which the Talos admin uses to announce runner redeploys to Discord.

Mirrors how the admin already bakes TALOS_ADMIN_COMMIT:

• contracts/dockerfile-actions: ARG GIT_COMMIT_SHA="" + ENV GIT_COMMIT_SHA=$GIT_COMMIT_SHA (empty default keeps local builds working).
• aws-deployment.yml: CI passes --build-arg GIT_COMMIT_SHA=${{ github.sha }}.

No @talos/client bump — the library already reads this env. Pairs with oplabs/talos#14.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.63%. Comparing base (804b89e) to head (24199d9).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2939   +/-   ##
=======================================
  Coverage   44.63%   44.63%           
=======================================
  Files         110      110           
  Lines        4920     4920           
  Branches     1362     1362           
=======================================
  Hits         2196     2196           
  Misses       2721     2721           
  Partials        3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.