verify-action-build: unified walker over composite action graph (closes #744)

[potiuk]

Closes #744.

Summary

Replace the per-check recursions in utils/verify_action_build/security.py with a single depth-first pre-order walker — walk_actions — that yields one VisitedAction per unique org/repo/sub_path@commit. Each security check becomes a pure function over visits:

for visited in walk_actions(root_org, root_repo, root_commit, root_sub_path):
    do_check(visited)

Motivation (from #744)

it looks like each check does its own recursion to perform tests on the same objects … N checks × M nested actions = N × M redundant fetches.

analyze_nested_actions and analyze_binary_downloads_recursive each re-fetched action.yml files and re-parsed the same uses: refs, with private _depth / _visited bookkeeping. As more checks land (e.g. the compatible-licensing check from #686), that cost compounds.

Changes

• walk_actions (new, security.py) — DFS pre-order generator that yields VisitedAction dataclasses (org, repo, commit_hash, sub_path, depth, action_yml, action_type, incoming_ref, parent_yml, approved, trusted). Enforces the shared descent rules in one place:
  • local (./…) and docker (docker://…) refs are terminal stubs
  • non-hash-pinned refs are yielded but not descended
  • trusted orgs (actions, github) at depth > 0 are yielded as stubs without fetching their action.yml
  • depth cap of 3
• analyze_binary_downloads_recursive — rewritten as a pure consumer of the walker; no recursion, no _depth / _visited kwargs.
• analyze_nested_actions — same treatment. Preserves existing display ordering (pre-order matches the old nested printout) and the checked_actions list returned to the summary table.
• fetch_action_yml is @lru_cache-wrapped — any remaining same-commit fetch inside a check (e.g. the lazy type lookup for a trusted-org ref in the nested-action display) reuses the walker's earlier hit.

Test plan

• All 135 existing tests pass: uv run --with pytest python -m pytest tests/ -q
• End-to-end: uv run utils/verify-action-build.py --from-pr 724 --ci still reports src/download/download-version.ts line 39 as an unverified tc.downloadTool call and exits 1
• CI green on this branch

Future follow-up

With the walker in place, the compatible-licensing check from #686 can be added as another pure function over visits instead of building a third recursive walk.

[potiuk]

cc: @dave2wave