Fix CI runner regressions

[Sunghoon Choi (hanbitmyths)]

Summary

• remove the obsolete --merge-runs SARIF Multitool option from Windows CI
• approve the onnxruntime-node postinstall script required to install native bindings under npm 11
• run macOS Node tests natively on ARM64 to match the hosted runner and bundled Darwin binding
• fetch full Git history so lintrunner can resolve the merge base with origin/main
• fall back to the immutable pull request head when GitHub has not generated a merge ref yet

These failures were exposed by the checks on #566. The Android failure in that run was a self-hosted runner communication outage and is not addressed by repository changes.

Validation

• reproduced npm 11.17's blocked onnxruntime-node postinstall and verified the unpinned allowScripts policy
• installed the native binding and ran the Node quick-start example successfully
• parsed all GitHub Actions workflow YAML files
• ran lintrunner with no lint issues
• checked all edited workflows with VS Code diagnostics
• verified the SARIF Multitool 5.6.0 merge options
• verified the pull request head ref resolves to the API-reported head SHA