ci: pin checkout SHA; explicitly checkout z-shell/zd in reusable workflow

[ss-o]

Summary

• Pin actions/checkout to a full commit SHA in the reusable test-native.yml workflow
• Explicitly checkout z-shell/zd (instead of using github.sha which is not cloneable as a branch ref when called from external repos via workflow_call)

Test plan

• Verify the reusable workflow can be called from z-shell/zi with workflow_call without checkout errors
• Confirm test-native.yml passes end-to-end

[Copilot]

Pull request overview

Updates the reusable native test workflow to be safer/more deterministic by pinning actions/checkout and ensuring the workflow checks out the intended repository when invoked via workflow_call.

Changes:

• Pinned actions/checkout to a full commit SHA in test-native.yml.
• Updated checkout step to explicitly clone z-shell/zd (instead of implicitly using the caller repo in workflow_call scenarios).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.