Enforce external plugin ref/sha consistency (#2463)

* Enforce external plugin ref/sha consistency

Extract shared ref/sha normalization and consistency checks into eng/lib and reuse them in intake plus quality gate flows.

Add a dedicated ref/sha consistency quality gate surfaced in PR/intake summaries, and add targeted tests for matching and mismatched refs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6afe21ad-eafa-4c90-a1f2-053dedac7625

* Address review: tree/blob ref errors and PR workflow ref/sha column

- resolveCommitShaAtReadRef: classify rev-parse failure as 'fail'
  instead of 'infra_error' because a successfully-fetched ref that
  doesn't dereference to a commit is a submitter problem, not infra.
- validateRemoteRepository (intake): treat HTTP 422 from the commit
  endpoint as a submitter error; all other non-404 errors remain
  transient warnings requiring maintainer re-run.
- external-plugin-pr-quality-gates.yml: add ref/sha consistency
  column to the per-plugin quality table and failure details block.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6afe21ad-eafa-4c90-a1f2-053dedac7625

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6afe21ad-eafa-4c90-a1f2-053dedac7625

eng/lib/external-plugin-source-ref-sha.mjs

@@ -0,0 +1,31 @@
+export function normalizeCommitSha(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+
+  const normalized = value.trim().toLowerCase();
+  return /^[0-9a-f]{40}$/.test(normalized) ? normalized : undefined;
+}
+
+export function evaluateRefShaConsistency({ ref, sha, resolvedRefCommitSha }) {
+  const normalizedSha = normalizeCommitSha(sha);
+  const normalizedRefCommitSha = normalizeCommitSha(resolvedRefCommitSha);
+
+  if (!normalizedSha || !normalizedRefCommitSha) {
+    return {
+      comparable: false,
+      matches: true,
+      normalizedSha,
+      normalizedRefCommitSha,
+    };
+  }
+
+  return {
+    comparable: true,
+    matches: normalizedSha === normalizedRefCommitSha,
+    normalizedSha,
+    normalizedRefCommitSha,
+    ref: typeof ref === "string" ? ref.trim() : "",
+    sha: typeof sha === "string" ? sha.trim() : "",
+  };
+}