fix(jax): stamp JAX wheels with the real source commit hash

[WBobby]

Motivation

jaxlib_git_hash was resolved by a git call that ran inside the manylinux
container, where git rejects the runner-owned checkout as dubiously owned. The
command substitution failed silently, so every JAX plugin wheel from these two
workflows was published without a git hash while the job stayed green.

Issue: #6978

Technical Details

This change:

• Resolves the hash on the host, where the checkout is owned by the user running
  the step, and forwards it with --env JAXLIB_GIT_HASH. Without the --env the
  reference inside the single-quoted script would be an unset container variable,
  i.e. the same empty value by a different route.
• Validates it as a 40-hex sha and fails the step otherwise, so "no hash" becomes
  a red job instead of a silently unstamped wheel. set -e already covers git
  exiting non-zero; the regex covers git succeeding with unexpected output.
• Sets safe.directory=* in the container via GIT_CONFIG_COUNT /
  GIT_CONFIG_KEY_0 / GIT_CONFIG_VALUE_0, mirroring
  dockerfiles/build_manylinux_x86_64.Dockerfile. This is defence in depth for any
  other git caller in the image; the hash itself no longer depends on it.

The inner script is otherwise untouched, and stays single-quoted because
$(rocm-sdk path --root) and $(pwd) must be evaluated in the container. Both the
release and CI workflows carried the identical line and are changed identically.

Test Plan

Dispatched multi_arch_build_linux_jax_wheels.yml on this branch for a single
matrix cell (build_mode=manylinux, python_version=3.14,
jax_ref=rocm-jaxlib-v0.10.0, rocm_version=7.15.0a20260728, release_type=dev,
tests skipped), then inspected the published wheel.

Test Result

Run 30425080495,
success in 49m37s. All 15 steps succeeded, the native v0.9.1 step was skipped as
expected, and dubious ownership appears 0 times in the log.
The hash is resolved on the host and reaches Bazel intact:
jaxlib_git_hash=98a16bf22b1cf8384b730e835d785cb0c68033d5
'build' options: ... --//jaxlib/tools:jaxlib_git_hash=98a16bf22b1cf8384b730e835d785cb0c68033d5
That sha is refs/heads/rocm-jaxlib-v0.10.0 in ROCm/jax, confirmed with
git ls-remote.
jax_rocm7_plugin/version.py in the published wheel, before and after:

	_release_version	_git_hash
before (nightly 20260728)	'0.10.0+rocm7.15.0a20260728'	None
after (this branch)	'0.10.0+rocm7.15.0a20260728'	'98a16bf22b1cf8384b730e835d785cb0c68033d5'

Submission Checklist

• Look over the contributing guidelines at https://github.com/ROCm/TheRock/blob/main/CONTRIBUTING.md.

[therock-pr-bot]

✅ All Checks Passed — Ready for Review

Check	Status	Details
📝 PR Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	✅ Pass	PR does not contain code files — Unit Test auto-passed
🔎 pre-commit	✅ Pass	—
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—
🤖 therock-pr-bot	✅ Pass	—

🎉 All checks passed! This PR is ready for review.

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?

[therock-pr-bot]

🎉 All checks passed! This PR is ready for review.

[ScottTodd]

The if and echo here look unnecessary, remove?

• If python build/build.py wants to reject JAXLIB_GIT_HASH values that don't match some pattern, that should be up to it. Keep workflows as simple as possible: https://github.com/ROCm/TheRock/blob/main/docs/development/style_guides/github_actions_style_guide.md#prefer-python-scripts-over-inline-bash
• Commands are already echo'd by default in github actions, no need to also run echo manually like this

[ScottTodd]

Could the container itself apply ownership settings for the checkout to fix instead? Again, prefer to keep workflows as simple as possible. Every single line of bash in a workflow should be scrutinized. Treat workflows as recipes for users to run. You wouldn't ask a user to run any of this code... right? Users should just run scripts in sequence. Same for workflows.