fn is_commit_sha(s: &str) -> bool
Returns true if the given string looks like a commit SHA (4-40 hex characters).