🐛 Report the real PR title, head commit, and author on GitHub pull_request runs

[Robdel12]

Why

On GitHub Actions pull_request runs, actions/checkout checks out the throwaway merge commit GitHub builds at refs/pull/N/merge. We already read the real head SHA from the event payload, but the commit message and build name still came from that merge commit. So every PR build showed up in Vizzly as Merge <sha> into <sha> and was named HEAD-<sha>. In production that's about 11k builds with the merge message and 6k with the HEAD- name, across customer projects too.

What changed

The CLI now resolves the build's commit once and describes everything from it. On GitHub PR runs, the commit message is the PR title, which matches what the squash-merged build on main shows later. VIZZLY_COMMIT_MESSAGE still wins. Outside that case, the message and author are read from the resolved head SHA with git log, and fall back to HEAD when a shallow clone doesn't have the SHA locally.

Build names are now generated from the CI-aware branch and commit detectors, so PR builds get <head-branch>-<head-sha7> instead of HEAD-<merge-sha7>.

Builds also send commit_author_name and commit_author_email, with VIZZLY_COMMIT_AUTHOR_NAME / VIZZLY_COMMIT_AUTHOR_EMAIL overrides and GitLab's CI_COMMIT_AUTHOR. The Vizzly app uses the email to match the build to an organization member for a new "Your builds" dashboard section. It doesn't store the email itself.

What we found

GitHub's synthetic merge commit keeps the PR head commit's author, so even a depth-1 checkout has the right author on HEAD. The event payload has the PR title but no head commit message, which is why the title is the reliable source on shallow clones.

Risk

The payload fields are additive and only sent when present. The server already accepted unknown build fields, and vizzly-testing/vizzly#843 starts using them. The new tests build a real repo shaped like GitHub's merge checkout (head commit present and missing), and the CI env tests now share one helper that clears CI variables, so they behave the same when run on Actions. The full suite, lint and type tests pass.

Follow-up

The Storybook, static-site and Swift clients create builds through services.git.detect() in plugin-api.js, so they don't send the author yet.