Add debug logging and guide for action pinning version comment flipping

[Copilot]

When workflows reference the same action with different version tags (e.g., v8 vs v8.0.0), both resolve to identical SHAs but create separate cache entries. This causes compiled lock files to flip between version comments depending on which workflow compiled last.

Changes

Enhanced debug logging across action resolution pipeline:

• action_pins.go: Logs duplicate SHA detection during resolution
• action_cache.go: Warns when adding duplicate SHA entries, logs deduplication details
• action_resolver.go: Logs GitHub API queries with endpoint details

Enable with: DEBUG=workflow:action_* gh aw compile

Debugging guide (specs/debugging-action-pinning.md):

• Root cause analysis with concrete examples
• Log interpretation patterns
• Four solution approaches (consistent versions, cache clearing, exact SHAs, canonical pins)
• Cache inspection commands and troubleshooting checklist

Test coverage for duplicate detection and deduplication logic.

Example Debug Output

workflow:action_cache WARNING: Adding cache entry actions/github-script@v8 with SHA ed597411 
  that already exists as actions/github-script@v8.0.0
workflow:action_cache This may cause version comment flipping in lock files. 
  Consider using consistent version tags.
workflow:action_cache Deduplicating: keeping actions/github-script@v8.0.0, removing actions/github-script@v8

Resolution

Developers can now:

1. Enable debug logging to observe the issue in real-time
2. Inspect cache with cat .github/aw/actions-lock.json | jq
3. Standardize version tags across workflows (recommended)
4. Clear cache if needed: rm .github/aw/actions-lock.json

No behavior changes—pure observability enhancement.

Original prompt

When compiling locally, it often happens that the action pinning switches between two versions that point ot the same long sha. Like

    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

This failure only seems to happen on a local dev-folder. Investigate the potential failure points and provide a debuggging plan for the developer (including which logs to enable), add more logs where it can be useful.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.