Bound the In-Process Composite-Actions Read Against an Alias-Expanded Step Name or Shell #2357

Problem

The repo gate's composite-actions check reads an action file with PyYAML in process where PyYAML imports. PyYAML keeps alias references shared, so loading a small file with nested aliases is fast. The check then formats a step's name and shell with str(), which walks the shared structure in full. A step whose name or shell is an alias to a nine-level, nine-way alias chain makes str() visit about 9^9 elements. The in-process read has no timeout of its own, so the gate hangs on a few hundred bytes of YAML.

The reader that #2348 adds for hosts without PyYAML projects only the fields the check reads, so it is not affected. The in-process lines are older than that change.

Done When

A step's name and shell are used only when they are strings, or are bounded before formatting, so a constructed alias-chain action file is read by the in-process path in about the same time as a plain one. A test carrying such a file proves it.

Found by a strict review pass on #2348.