Bench: record and validate local dependency revisions in published reports

Parent: #62\nRelated: #114\n\nThe comparison runner records the zig-js commit and rejects a dirty zig-js tracked worktree, but zig-js resolves zig-gc and zig-regex from sibling path dependencies. A published engine score is therefore not fully reproducible when the dependency revisions are omitted.\n\nRecord both sibling commit IDs and tracked-dirty state in benchmark metadata, refuse publication if any benchmark-affecting tracked worktree is dirty, cover the guard behavior in the harness unit tests, and expose the revisions in every dated report.

Completed by 9e832d1 (bench: record dependency revisions (#115)). The harness now records zig-js, zig-gc, and zig-regex commits and rejects publication when any tracked dependency worktree is dirty. The seven structural harness tests pass, and the generated July 14 report contains all three exact revisions.