feat(fleet): add shared fleet-repin composite action

[joshua-temple]

Problem

The mutation logic that repins each example repo to the rc under test lives inline in the repin job of fleet-e2e.yaml, where it clones every repo fresh. There is no reusable unit that a suite can call to repin the checkout it already has, and no automated coverage of the version+sha repin contract.

Fix

Adds .github/actions/fleet-repin/action.yaml, a composite action carrying the repin mutation, install-and-assert, push-retry, and read-back-verify logic. It differs from the parent job by mutating the job's EXISTING checkout in place and leaving the workspace at the pushed commit, so later steps in the same job read the repinned manifest.

The action is INERT: no caller is wired up, so fleet runs are byte-for-byte unchanged. Behavioral contract (all fail-closed):

• Both version and sha empty is a loudly logged no-op success (standalone/scheduled path).
• Exactly one of the pair set hard-fails (a half-set pair is a wiring bug).
• The rc CLI is installed from stablekernel/cascade and its self-reported version is asserted against the dispatched tag before anything is mutated.
• Manifest cli_version / cli_version_sha are set, other in-repo prerelease refs rewritten, workflows regenerated, then pushed to main with a bounded fetch/reset/re-apply retry loop (normal push, DCO sign-off, no GPG).
• Already-pinned is a clean no-op so lane re-dispatch is safe.
• Read-back verifies main carries the rc, with the same retry budget.

Adds e2e scenario 45-fleet-repin-version-sha-idempotent.yaml covering the CLI-level contract: a pin_mode: sha manifest carrying a cli_version + cli_version_sha pair emits sha-mode refs, generate-workflow --force regenerates drift-free and idempotent, and both pin fields survive.

Verification

• go build ./..., go test ./... (2351 pass), golangci-lint run ./...: clean
• cd e2e && go build ./... && go vet ./...: clean
• Scenario 45 discovered, parsed, and validated by the harness parser
• shellcheck -s bash over the embedded action script: clean
• actionlint over the workflows tree: no new findings