fix(ci): fix toolchain version probe — correct packages path and PKG_TO_TOOL names

[DimaBir]

Summary

• Fixes the probe always failing with "no tool versions resolved" — the script was scanning .gdn/i/ (doesn't exist) instead of $RUNNER_TEMP/../_msdo/packages/nuget/
• Fixes PKG_TO_TOOL map with actual Guardian NuGet package names (Microsoft.Guardian.TrivyRedist_linux_amd64, etc.) discovered from run logs
• Adds eslint version read from node_modules/eslint/package.json (npm install path)
• Replaces raise SystemExit guard (was failing the job) with a graceful skip via steps.collect.outputs.skip_commit — job passes, last known-good toolchain-versions.json is preserved

Root cause

The packages directory assumption was based on the old .gdn/i/{type}/ layout. MSDO CLI actually installs to $RUNNER_TEMP/../_msdo/packages/nuget/ with Guardian-prefixed package names. Confirmed from run #23405537434.

Confirmed package names (from run logs)

Tool	NuGet package
bandit	Microsoft.Guardian.BanditRedist_linux_amd64
binskim	Microsoft.CodeAnalysis.BinSkim
checkov	Microsoft.Guardian.CheckovRedist_linux_amd64
templateanalyzer	Azure.Templates.Analyzer.CommandLine.linux-x64
terrascan	Microsoft.Guardian.TerrascanRedist_linux_amd64
trivy	Microsoft.Guardian.TrivyRedist_linux_amd64
eslint	npm → node_modules/eslint/package.json

Test plan

• Trigger probe manually after merge: gh workflow run toolchain-version-probe.yml
• Verify toolchain-versions.json committed with all 7 tools resolved
• Verify trivy shows 0.69.3 (confirming pinned version visibility for breach monitor)