fix(onnx): give SOURCE_COMMIT a use, instead of a lint suppression

Lint caught it and was right: `SOURCE_COMMIT` existed only to be read out
of this file by a `sed` in the workflow, which makes it dead as far as
this module is concerned and fragile as a design — nothing in the file
explains why it cannot be deleted.

It now prints when the fetched artifact is one we built (`spec.baseUrl`
set):

    built here from microsoft/onnxruntime@df2ba1cf…

which is the line somebody wants when the binary no longer carries
Microsoft's name and they are trying to work out what it came from. The
upstream path is unchanged and prints nothing extra, because for an
upstream artifact the URL already says.

Exercised, not assumed: `node scripts/fetch-onnxruntime.mjs --force`
downloads, verifies and vendors as before, exit 0, and the new line stays
quiet because the upstream entry has no `baseUrl`.

Author: EtienneLescot

scripts/fetch-onnxruntime.mjs

@@ -325,6 +325,13 @@ async function main() {
 		if (targetPlatform !== "win32") fs.chmodSync(dest, 0o755);
 
 		console.log(`  ${banner}`);
+		// Où que viennent les octets, dire de quelle source ils sortent. Pour un artefact
+		// amont c'est le tag ; pour un que nous avons construit (`baseUrl`), c'est le commit
+		// que le workflow a compilé, et c'est la seule chose qui rend le binaire traçable
+		// une fois qu'il ne porte plus le nom de Microsoft.
+		if (spec.baseUrl) {
+			console.log(`  built here from microsoft/onnxruntime@${SOURCE_COMMIT}`);
+		}
 		console.log(`\nVendored -> ${dest}`);
 	} finally {
 		fs.rmSync(tmp, { recursive: true, force: true });