don't use String to represent SHAs internally

[adriaanm]

one reason to make sure to resolve commit SHAs to a standard, sufficiently long representation, is that github's commit status api does not recognize deadbeef and deadbee as shas for the same commit