fix(ci): capture sanitize commit SHA, fail cleanly on rebase conflict

Addresses review feedback on #2888 without widening the revert scope
back to a moving target:

- prebuild-sanitize's own [nobuild] commit lands on top of HEAD_SHA
  within the same run, so before..HEAD_SHA doesn't include it. It's
  still this push's own fallout, not a neighboring push's, so capture
  its SHA via job output and revert it explicitly (reverted first,
  since it's on top).
- git rebase in the push-retry loop could conflict and get killed
  silently by set -e, burning the remaining retry attempts. Abort the
  rebase and fail loudly instead.

.github/workflows/onpush_builder.yaml

@@ -55,6 +55,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+    outputs:
+      sanitizeCommitted: ${{ steps.sanitize_commit.outputs.committed }}
+      sanitizeCommitSha: ${{ steps.sanitize_commit.outputs.commit_long_sha }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -90,6 +93,7 @@ jobs:
         uses: ymwymw/check-mixed-line-endings@v2
 
       - name: Commit sanitize changes
+        id: sanitize_commit
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
         uses: EndBug/add-and-commit@v10
         with:
@@ -410,6 +414,8 @@ jobs:
         env:
           BEFORE: ${{ github.event.before }}
           HEAD_SHA: ${{ github.sha }}
+          SANITIZE_COMMITTED: ${{ needs.prebuild-sanitize.outputs.sanitizeCommitted }}
+          SANITIZE_SHA: ${{ needs.prebuild-sanitize.outputs.sanitizeCommitSha }}
         run: |
           set -euo pipefail
 
@@ -428,6 +434,15 @@ jobs:
             commits=("$HEAD_SHA")
           fi
 
+          # The prebuild-sanitize job may have pushed its own [nobuild] commit
+          # on top of HEAD_SHA earlier in this same run. It's still this push's
+          # own fallout (not a neighboring push's), so revert it explicitly by
+          # SHA rather than widening the range to "whatever is on master now."
+          # It must be reverted first, since it sits on top of HEAD_SHA.
+          if [ "$SANITIZE_COMMITTED" = "true" ] && [ -n "$SANITIZE_SHA" ]; then
+            commits=("$SANITIZE_SHA" "${commits[@]}")
+          fi
+
           if [ "${#commits[@]}" -eq 0 ]; then
             echo "Nothing to revert."
             exit 0
@@ -446,7 +461,13 @@ jobs:
             fi
             echo "Push rejected, rebasing onto latest master (attempt ${attempt})"
             git fetch origin master
-            git rebase origin/master
+            if ! git rebase origin/master; then
+              git rebase --abort
+              echo "Rebase hit a real conflict against latest master; aborting" \
+                   "rather than pushing a partial/broken revert. This needs a" \
+                   "human to look at it." >&2
+              exit 1
+            fi
           done
 
           echo "Failed to push reverts after retries" >&2