fix: an artifact's revision breaks a same-second tie toward the newest commit

Two commits pushed together can share a committer second. artifacts.sh sorted
the whole "<time> <sha>" line, so a tie went to the larger hash, here the
parent. Its revision then named a commit the image's content had moved past,
and test_artifact_identity (which takes git's own order among equals) caught
it. A stable sort on the timestamp alone keeps git log's order, so the
descendant wins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/artifacts.sh

@@ -136,9 +136,14 @@ newest() {
 
   # Unquoted on purpose: the pathspec must word-split into separate args.
   # Globbing is off script-wide (`set -f`).
+  #
+  # Newest committer time wins. Two commits pushed together can share a
+  # second, and then the one git log lists first (the descendant, which holds
+  # both changes) wins: a stable sort on the timestamp alone keeps git's order
+  # among equals. Sorting on the whole line would break the tie by hash.
   # shellcheck disable=SC2086
   set -- "$(cd "$ROOT" && git log --format='%ct %H' HEAD -- $paths \
-            | sort -n | tail -1)"
+            | sort -s -k1,1nr | head -1)"
   if [ -z "$1" ]; then
     echo "artifacts.sh: no commit touches this artifact's shipped files" >&2
     exit 1