Setup Job: announce when running with locked dependencies

[nodeselector]

Why

When a job runs with lockfile-pinned action dependencies, the runner already receives the resolved pins (via #4372 propagate actions dependencies) but gives the user no signal that pinning is in effect. This closes that feedback gap in the most visible place: the Set up job log.

What

In JobExtension.InitializeJob, the "Set up job" block now prints a single line whenever the job message carries a non-empty ActionsDependencies list:

Running with locked dependencies

No lockfile means an empty list means no line, so the behavior is gated purely on the presence of dependency data. No feature flag is needed. This is intentionally a single announcement line, not an enumerated list, per the product decision for this iteration.

Note on the tracking issue title

The tracking issue's title says "show pinned dependencies" (i.e. enumerate them). The shipped behavior here is the minimal boolean-style line, not an enumeration, per the product owner's direction. The issue may be retitled separately. Flagging so reviewers aren't confused by the title vs. behavior mismatch.

Bundled unrelated fix (please note)

This PR also fixes a pre-existing env-var leak in the test JobExtensionBuildFailsWithoutContainerIfRequired: it set RequireJobContainer=true via Environment.SetEnvironmentVariable and never reset it. Because L0 tests share a process, that leak caused the two new lockfile tests to fail depending on ordering (they hit ValidateJobContainer and threw). I wrapped that test's body in try/finally to reset the variable.

It is unrelated to the feature but was necessary to make the new tests reliable, which is why an otherwise-untouched test changed. It is a small, self-contained change; happy to split it into its own PR if reviewers prefer.

Testing

• JobExtensionL0 suite: 27/27 passing via the repo's local SDK (./dev.sh).
• Note: ./dev.sh format crashes in my local environment (a Mono build-host crash inside dotnet format, reproducible on a clean tree too), so I matched the surrounding code style manually. Please rely on the CI format check for formatting validation rather than assuming local format was run.

Changes

• src/Runner.Worker/JobExtension.cs - emit Running with locked dependencies when message.ActionsDependencies is non-empty.
• src/Test/L0/Worker/JobExtensionL0.cs - two L0 tests (line present when deps present, absent when empty) plus the env-var leak fix described above.

Towards: github/actions-dispatch#567

[Copilot]

Pull request overview

This PR adds a user-visible cue in the Set up job log when the server provides lockfile-pinned action dependency data, and updates L0 coverage to validate the presence/absence of that cue. It also fixes a pre-existing test process-wide environment variable leak that was making the new tests order-dependent.

Changes:

• Emit Running with locked dependencies during job initialization when message.ActionsDependencies is non-empty.
• Add L0 tests asserting the new log line appears only when dependency data is present.
• Reset RequireJobContainer env var in the existing L0 test to avoid cross-test leakage.

Show a summary per file

File	Description
src/Runner.Worker/JobExtension.cs	Outputs a single “locked dependencies” announcement during setup when the job message includes dependency pins.
src/Test/L0/Worker/JobExtensionL0.cs	Adds L0 coverage for the new setup output and fixes an env-var leak that could break tests depending on execution order.

Review details

Comments suppressed due to low confidence (1)

src/Test/L0/Worker/JobExtensionL0.cs:298

• The test now clears RequireJobContainer by setting the env var to null in finally. If the variable was already set (e.g., in CI or when running tests with custom env), this changes global process state and can cause ordering-dependent failures. Capture the original value before setting it and restore that exact value in the finally block.

 [InlineData("write")]
[InlineData("write-only")]
public async Task InitializeJob_LogsCacheMode_WhenVariableSet(string mode)
{
using (TestHostContext hc = CreateTestContext())

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Low

[thboop]

Suggested change

	context.Output("Running with locked dependencies");
	context.Output("Using pinned Action versions");

[thboop]

This reads a little clearer to me but its mostly a nit comment