fix(ontology): read the ontology commit SHA from git metadata

[devin-ai-integration]

Summary

Clears the one SonarCloud finding on the upstream sync PR: go:S4036 ("Make sure the PATH variable only contains fixed, unwriteable directories") on the ontology table generator, which resolved git through PATH:

-	cmd := exec.Command("git", "-C", root, "rev-parse", "HEAD")
-	sha, err := cmd.Output()

Rather than pinning an absolute git path, commitSHA now reads the checkout's plumbing files directly, which removes the finding at its root and drops a git binary dependency from a code generator: .git/HEAD → symref → loose ref under refs/, falling back to packed-refs (the case that actually matters, since a fresh git clone usually has the branch packed and no loose ref), plus raw-SHA detached HEAD, a .git file containing gitdir:, and worktree commondir for where refs live.

Every failure path returns a *gitMetadataError naming the file it could not read, and the result must match ^[0-9a-f]{40}$ before it is returned — the generator prints commit[:12], so a short or garbage value would otherwise be recorded in the generated table (or panic the slice).

internal/core/rdf/ontology/table.go is untouched and verified byte-identical to main: the recorded SHA does not change here.

Tests build the fixtures as temp directories and cover symref→loose, symref→packed, detached HEAD, the gitdir: file, missing HEAD, and a malformed SHA.

Verification: go build ./..., go vet ./..., gofmt -l . (empty) and the full go test ./... all pass, including internal/core/model (the training-corpus gate).

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/6eb85b61128b4de8bdcfd7991202ccdc
Requested by: @HuiJun

---

[devin-ai-integration]

Original prompt from jason.han

@JPL-Devin/OpenSysML Help me adjust the 0.1.1 release that has been prepared

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.