fix(ci): fetch the base ref with full history so the scope check has a merge base

[kyle-sexton]

Summary

scripts/verify-security-review-evidence.sh fetched the base ref shallow and then asked for a
three-dot diff against it:

git fetch origin "$base_ref" --depth=1 >/dev/null 2>&1 || true
# ...
git diff --name-only origin/<base>...HEAD

A three-dot diff needs a merge base. --depth=1 truncates the base ref to a lone commit, so any
branch not sitting on the base's current tip dies with fatal: origin/main...HEAD: no merge base
before the scope check can run. At this repo's merge rate that is most PRs more than a few minutes
old.

Observed on #2539: deterministic across two independent runs (31655807987, jobs 94310219602 and
94312908610), branch seven commits behind main.

The failure is fail-closed — correct, and clearly deliberate in the script's comments — but the guard
never reaches the evidence check it exists to perform, and goes red on PRs it has nothing to say
about.

Fix: drop --depth=1. .github/workflows/claude-security-review.yml already checks out with
fetch-depth: 0, so this is a normal fetch against an already-complete clone, not a cost regression.
Nothing about the fail-closed posture changes.

Not done here: defending against being called from a genuinely shallow clone
(--is-shallow-repository → --unshallow). The only caller checks out full history, so that would
be scaffolding for a case that does not exist. Raised as a question in #2553 rather than built.

Test plan

• scripts/verify-security-review-evidence.sh.test.sh — all checks pass, including two new ones:
  • a static guard that fails if a --depth fetch of the base ref is reintroduced;
  • a behavioural test building a behind-main fixture repo and asserting both directions — the
    full fetch yields a working three-dot diff, and the shallow fetch breaks it. The second
    assertion fails loudly if the regression ever stops being real, so the test cannot start passing
    vacuously and leave the static guard unexamined.
• scripts/affected-tests.sh --run — 1 suite selected, passes.
• shellcheck with the repo's .shellcheckrc: exit 0, matching the pre-change baseline
  (verified by stashing and re-running). The fixture chains with && rather than set -e because
  enabling errexit anywhere in that file switches on SC2310 for every pre-existing
  function-in-a-condition above it; the one new SC2016 carries the same disable directive and
  rationale the file already uses two blocks earlier.
• editorconfig-checker clean; no file-mode changes.

Related

Closes #2553

Found while shipping #2539, where this gate went red on a docs-only change with no finding of its
own.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[kyle-sexton]

Closing as superseded: #2548 (merged to main as 04f9cee8) removed the local scope check and git fetch --depth=1 path entirely — the guard now reads the lane's declared LANE_RELEVANT output instead of running its own three-dot diff. The shallow-fetch defect this PR targeted no longer exists on main.

[kyle-sexton]

Superseded by #2548 — the shallow-fetch scope check this PR patched was removed from the guard entirely.