fix(actions): address remaining review points — ownership docs, log levels, tests

- Expand NewInterpeter ownership comment to explicitly confirm that
  run.Workflow is fresh per call and job is only read (not written),
  so concurrent calls for different matrix combinations are race-free
- Downgrade the two remaining log.Info lines (matrix re-evaluation
  complete / succeeded) to log.Debug per reviewer request
- Add unit tests for constructWorkflowWithNeeds (happy path, invalid
  payload, missing jobs section), mergeNeedsIntoVars, and a
  multi-dimension dynamic matrix case in TestHasMatrixWithNeeds

Co-Authored-By: Claude <claude-sonnet-4-5@anthropic.com>

modules/actions/jobparser/interpeter.go

@@ -34,7 +34,11 @@ func NewInterpeter(
 		JobID: jobID,
 	}
 
-	// Add the current job to the workflow so run.Job() doesn't return nil
+	// run.Workflow is allocated above and never shared: each call to NewInterpeter
+	// creates its own *model.Run. Writing job into the fresh Jobs map here is
+	// therefore safe even when NewInterpeter is called concurrently for different
+	// matrix combinations of the same job. The job pointer itself is only read
+	// (for Strategy and Needs()), never written through.
 	run.Workflow.Jobs[jobID] = job
 
 	for id, result := range results {