fix(ci): the agy local-diff fallback cannot merge-base in a shallow clone

Synced from RustyNES (PR #375), stacked on the file-count fix in this same
branch. That fix alone is not enough: it gets the fallback started, and then the
run dies one step later.

    [agy-review] diff exceeds GitHub's 300-file API limit; falling back to a local git diff
    [agy-review] fetched PR refs using git's ambient credentials
    [agy-review] could not compute the merge base for PR #373

The workflow checks out with `fetch-depth: 1`, deliberately -- the comment says
the fallback "fetches exactly the two refs it needs on demand, so a full history
clone would be paid on every run for a path most runs never take". But two refs
fetched into a shallow repository arrive as DISCONNECTED shallow histories, with
no common ancestor for `git merge-base` to find, so it fails even though both
fetches succeeded.

Asks the compare API for the merge base and fetches that single commit instead
of unshallowing. Diffing two commits needs both trees, not the history between
them, so a shallow fetch of the merge base suffices, and a repo with a large
history does not pay a full clone on a path that exists only because the PR is
already unusually big. `--deepen=250` covers a server that refuses a bare-SHA
fetch.

Verified upstream against a genuinely shallow clone -- the earlier attempt was
checked in a full clone, where `git merge-base` succeeds and the bug cannot be
seen. Reproduced the runner's exact failure at `--depth 1`, then confirmed the
fix in that same clone: merge base resolved via the API (identical to a full
clone's `git merge-base`), SHA fetch accepted, resulting diff 12,021 lines /
586,242 bytes.

Author: doublegate

scripts/agy-review.sh

@@ -175,7 +175,7 @@ trap cleanup EXIT
 # but is NOT harmless now that isCrossRepository gates whether an untrusted diff
 # reaches agy: a lookup failure must never be indistinguishable from "same-repo".
 diff_file="$(mktemp)"; meta_file="$(mktemp)"; diff_err="$(mktemp)"
-gh pr view "$PR" --repo "$REPO" --json title,isCrossRepository,baseRefName > "$meta_file" \
+gh pr view "$PR" --repo "$REPO" --json title,isCrossRepository,baseRefName,headRefOid > "$meta_file" \
   || { log "gh pr view failed; refusing to review without knowing the PR's head repo"; exit 1; }
 
 # THE FORK GATE (see the trust model at the agy invocation below). The workflow `if:`
@@ -260,8 +260,32 @@ if ! gh pr diff "$PR" --repo "$REPO" > "$diff_file" 2>"$diff_err"; then
       log "could not fetch PR #${PR} refs for the local diff fallback"
       exit 1
     fi
-    merge_base="$(git merge-base "$base_local" "$pr_ref")" || {
-      log "could not compute the merge base for PR #${PR}"; exit 1; }
+    # The workflow clones with `fetch-depth: 1`, so the two refs above arrive as
+    # DISCONNECTED shallow histories -- there is no common ancestor for
+    # `git merge-base` to find, and it fails even though both refs fetched fine.
+    # (A full local clone hides this completely, which is how it got missed.)
+    #
+    # Ask the API for the merge base and fetch that one commit, rather than
+    # unshallowing: a repo with a large history would pay a full clone on a path
+    # that only exists because the PR is already unusually big. Diffing two
+    # commits needs both trees, not the history between them, so a shallow fetch
+    # of the merge base is enough.
+    merge_base="$(git merge-base "$base_local" "$pr_ref" 2>/dev/null || true)"
+    if [ -z "$merge_base" ]; then
+      head_sha="$(jq -r '.headRefOid // empty' "$meta_file")"
+      api_base="$(gh api "repos/${REPO}/compare/${base_ref}...${head_sha}" \
+                    --jq '.merge_base_commit.sha' 2>/dev/null || true)"
+      if [ -n "$api_base" ] && [ "$api_base" != "null" ]; then
+        if git fetch --no-tags --quiet origin "$api_base" 2>/dev/null \
+           || git fetch --no-tags --quiet --deepen=250 origin "${fetch_refspecs[@]}" 2>/dev/null; then
+          merge_base="$(git merge-base "$base_local" "$pr_ref" 2>/dev/null || echo "$api_base")"
+          log "shallow clone: merge base ${merge_base} resolved via the compare API"
+        fi
+      fi
+    fi
+    if [ -z "$merge_base" ]; then
+      log "could not compute the merge base for PR #${PR}"; exit 1
+    fi
     git diff "$merge_base" "$pr_ref" > "$diff_file" || {
       log "local git diff failed for PR #${PR}"; exit 1; }
     log "local diff: $(wc -l < "$diff_file") lines, $(wc -c < "$diff_file") bytes"