Hotfix cherry-pick provenance checker flags merge commits as missing provenance

**AI disclosure**: This issue was drafted and analyzed with Codex using GPT-5.4. I have reviewed the analysis, and I am responsible for the content.

### Self Checks
- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
- [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
- [x] I confirm that I am using English to submit this report, otherwise it will be closed.
- [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
- [x] Please do not modify this template :) and fill in all the required fields.

### Dify version
`main` branch workflow as of July 15, 2026. The failing run loaded `.github/scripts/check-hotfix-cherry-picks.sh` from `origin/main` at `5998d5564d60428dbf516f0a9cb4293278f1d873`.

### Cloud or Self Hosted
- [x] Self Hosted (Source)

### Steps to reproduce
1. Create a PR against a hotfix branch and cherry-pick the required commits from `main` with `git cherry-pick -x`.
2. Ensure each cherry-picked commit includes provenance. In the example below, the four single-parent commits all include `(cherry picked from commit )`:
- `65a1d1f0dcb9ae80ffdbb4f0570008df63e856ed`
- `5633511ba7579d7758aec5db287bf45a4ad9f3e6`
- `035b340ba2417adf4acbd77e6ed7ed4a57db4757`
- `9120d4cdcc50f7e52d13249abf09b8e711cf02e5`
3. Merge the base hotfix branch into the PR branch to sync it, which creates a normal merge commit. In this case the merge commit was `a80befb93960207d1123c99b0df4e0a295251196` (`Merge branch 'hotfix/1.15.0-fix.11' into chore/cve-3.11.1-hotfix.11`).
4. Open or update the PR so the `Hotfix Cherry-Pick Provenance` workflow runs.
5. Observe the job failing on the merge commit instead of the cherry-picked commits.

Repro context:
- PR: [#38990](https://github.com/langgenius/dify/pull/38990)
- Failing run: [actions/runs/29395465467/job/87287867887](https://github.com/langgenius/dify/actions/runs/29395465467/job/87287867887)
- Current checker implementation: `.github/scripts/check-hotfix-cherry-picks.sh` iterates `git rev-list --reverse "$BASE_SHA..$HEAD_SHA"`, so merge commits are included in the validation set.

Observed error:

```text
ERROR: Commit a80befb93960207d1123c99b0df4e0a295251196 (Merge branch 'hotfix/1.15.0-fix.11' into chore/cve-3.11.1-hotfix.11) is missing cherry-pick provenance. Changes should be made from the main branch using git cherry-pick -x. If version differences prevent using git cherry-pick -x, manually add '(cherry picked from commit )' to the commit message.
```

### ✔️ Expected Behavior
`Hotfix Cherry-Pick Provenance` should validate the provenance of actual cherry-picked commits only. A merge commit created by syncing the PR branch with its base hotfix branch should be skipped, or at least should not be required to contain `(cherry picked from commit )`.

### ❌ Actual Behavior
The checker fails the PR because it inspects the merge commit `a80befb93960207d1123c99b0df4e0a295251196`, which is not itself a cherry-pick commit and cannot reasonably satisfy the provenance rule. In the example above, all four single-parent cherry-picked commits already had valid provenance, but the PR still failed.

A straightforward fix would be to skip merge commits before applying the provenance check, for example by excluding commits with more than one parent or by using `git rev-list --no-merges` for the validation input.

Start with .github/scripts/check-hotfix-cherry-picks.sh and inspect how its git rev-list output feeds the provenance validation. Reproduce the workflow with the linked failing run or the listed merge commit, then verify that merge commits are excluded while the four single-parent cherry-picked commits remain checked.

Written by the indexing model from the issue text.