Fix CI runner regressions

[Sunghoon Choi (hanbitmyths)]

Summary

• remove the obsolete --merge-runs SARIF Multitool option from Windows CI
• approve the onnxruntime-node postinstall script required to install native bindings under npm 11
• run macOS Node tests natively on ARM64 to match the hosted runner and bundled Darwin binding
• run Android tests on GitHub-hosted Ubuntu with KVM instead of the unavailable 1ES pool
• fetch full Git history so lintrunner can resolve the merge base with origin/main
• fall back to the immutable pull request head when GitHub has not generated a merge ref yet

These failures were exposed by the checks on #566 and subsequent validation runs on this PR.

Validation

• reproduced npm 11.17's blocked onnxruntime-node postinstall and verified the unpinned allowScripts policy
• installed the native binding and ran the Node quick-start example successfully
• passed all 10 Node.js matrix jobs, including macOS Node 20, 22, and 24 on ARM64
• passed all seven Android jobs on GitHub-hosted Ubuntu, including emulator setup and instrumentation tests
• parsed all GitHub Actions workflow YAML files
• ran lintrunner with no lint issues
• checked all edited workflows with VS Code diagnostics
• verified the SARIF Multitool 5.6.0 merge options
• verified the pull request head ref resolves to the API-reported head SHA