cot_verify does not download `actions.json` artifact from other action tasks

This means that if you have an action task that was created from the graph of another action task, CoT will fail as the actions.json artifact will be missing from the file system.

This was borne out of an assumtion that actions would only be triggered from on-push Decision tasks, and not other action graphs. I hit it when I was attempting to rebuild cached tasks for a chain of trust rotation and retriggered a task that was part of a release-promotion graph. So this task had a parent that was an action (retrigger), whose parent was also an action (release-promotion).

This case is easily worked around by using add-new-jobs from an on-push Decision graph, so it's not hugely important to fix. Though I do think it would be nice to make this edge case work in case anyone else runs into it in the future.

Start by tracing the cot_verify entry point and how it obtains the actions.json artifact for tasks created from action graphs. Reproduce a chain where an action task has an action parent, then ensure the artifact is available before verification; confirm the existing on-push Decision workaround is no longer required for this case.