Did I commit a sin by searching for publicly available university information online to prevent harm to the institution, and would I commit a sin if I reported my colleague to the administration for cheating and claiming to have a PhD that he does not possess?

What you did is considered impermissible spying, which involves searching for people's faults and prying into their private matters. Allah has forbidden this, saying: "And do not spy." It is not permissible to spy or to unveil people's secrets in order to uncover their wrongdoings, for the Prophet, peace and blessings be upon him, said: "O you who have believed with your tongues but faith has not entered your hearts, do not backbite Muslims, nor seek out their faults. For whoever seeks out their faults, Allah will seek out his faults, and whoever Allah seeks out his faults, He will expose him in his very home."

If you are not responsible for the employees, you should not do that. Do not repeat such an act, and do not inform the management about the matter.

However, if you are certain that a definite harm will befall the institution due to your colleague's cheating in his certificate, then advise him. If he does not respond, you may inform the management so they can take precautions. This is considered sincere advice (nasihah) and not forbidden tale-bearing (namimah), for the Prophet, peace and blessings be upon him, said: "Religion is sincere advice." In this case, it is better to subtly hint to those in charge of the institution to investigate and verify the authenticity of the employees' certificates.