[BUG] apm --version reports unrelated parent Git repository SHA

Describe the bug

apm --version can report an unrelated parent Git repository commit as though it were the APM build commit.

The packaged apm_cli.version.get_build_sha() has no injected __BUILD_SHA__. For a non-frozen installation it runs git rev-parse --short HEAD from its installed Python library directory. Git walks upward and may discover an unrelated ancestor repository.

To Reproduce

With APM 0.31.0 installed through Homebrew, run:

$ apm --version
Agent Package Manager (APM) CLI version 0.31.0 (edb70f031e)

The displayed SHA belongs to the Homebrew repository rather than APM:

$ git -C /opt/homebrew show -s --format='%H%n%s' edb70f031e
edb70f031e4170c780799633a1226ff73e1077f4
Merge pull request #24018 from Homebrew/sandbox-security-review

For comparison, the native APM v0.31.0 release archive reports:

Agent Package Manager (APM) CLI version 0.31.0 (8fd10ac)

Expected behavior

Installed PyPI/Homebrew packages should either:

1. report a release SHA embedded during the package build, or
2. omit the SHA when no trustworthy APM source checkout can be identified.

Runtime Git fallback should only be used after proving that the resolved repository is the APM source checkout. It must not accept an arbitrary ancestor Git repository.

Environment (please complete the following information):

• OS: macOS
• Python Version: 3.14.7
• APM Version: 0.31.0 installed with the Homebrew core formula
• VSCode Version (if relevant): Not applicable

Logs

The relevant command output is included in the reproduction above.

Start by inspecting apm_cli.version.get_build_sha() and the package build path that supplies BUILD_SHA. Reproduce apm --version from an installed package inside an unrelated Git checkout, then verify that the command reports an embedded release SHA or omits the SHA rather than accepting an ancestor repository. Confirm behavior for a genuine APM source checkout as well.