fix(sync): use git commit date for package version released_at

[maartenbode]

• SyncRefAction was hardcoding released_at = now(), so freshly synced versions looked just-released even when the tag was weeks old.
• Now resolves to: provider commit date → composer.json.time → now(). New getCommitDate() on GitProviderInterface covers GitHub, GitLab, Bitbucket, and the cached git clone; GenericGitProvider returns null.