fix(cli): repair shallow boundaries dropped by the stale-graft prune and keep them pruned safely (#108286, salvage #108361)

[kshitijk4poor]

Summary

prune_stale_shallow_grafts() (landed via #108053) dropped .git/shallow grafts that reflog-only commits still needed, leaving shallow installer checkouts with a commit whose parent object was never downloaded: git gc, git fsck --connectivity-only, and git fetch's auto-maintenance all fail (#108286), and the corruption cannot self-heal because reflog expiry happens during git gc — exactly the command that broke.

Salvage of #108361 by @JoaoMarcos44 (cherry-picked, authorship preserved) plus a rework commit fixing the blocking review findings on the original PR. Complements the prevention fix #108290.

What changed

• repair_broken_shallow_boundaries() in hermes_cli/gitlock.py: re-appends missing shallow boundaries for fetch-recorded tips (commits in refs/remotes/* reflogs) whose parent objects are absent. Called before the prune at both updater call sites (_cmd_update_check, _cmd_update_impl).
• prune_stale_shallow_grafts() fail-safe now also walks rev-list --all --reflog, so a boundary a reflog-only commit still needs is never dropped (without this, the production repair→prune sequence re-broke the repo on every run).

Rework of the original PR (blocking review findings, each reproduced with real-git probes)

• Repair undone by prune: verified — repair restored the boundary, the immediately-following prune dropped it again, rev-list back to rc 128. Fixed with the prune fail-safe --reflog leg; regression test added.
• Commit-message parsing: a parent <sha> line in a commit message body was parsed as an edge, shallow-marking a healthy HEAD and truncating visible history 3→1. Fixed with header-only parsing (stop at the blank line); guard test at the _batch_missing_parents seam.
• Corruption masking: any missing parent object was re-labelled as shallow history (fsck went "clean" while the object stayed absent). Fixed by restricting candidates to refs/remotes/* reflog tips instead of --batch-all-objects; guard test deletes an object and asserts fsck still reports it.
• Concurrent-writer race: the temp+os.replace write clobbered a concurrent depth-1 fetch's boundary, and the rollback then made the repo worse. Fixed with git's own shallow.lock protocol, held across read→write→verify→restore in both shallow writers.
• Cost: repair now gates on a cheap rev-list --all --reflog probe (healthy updates pay one subprocess instead of 5–6); test-file footguns fixed (encoding=, as_uri()).

Validation

• 68 focused tests green (repair 9, graft prune 3, tmp packs 5, update check 4, cmd update 47) via the repo venv, merge-tree clean vs main.
• Mutation checks: neutralizing the repair → 3 core tests red; removing the prune fail-safe --reflog leg → sequence test red; removing the header stop → parser guard red. All restored green.
• Two-cycle E2E of the production sequence on a real corrupted fixture: run 1 repairs (rev-list rc 0, fsck clean, git gc rc 0), run 2 stays fixed.
• Ruff, windows-footgun (incl. explicit scan of the new test file), compat-pointer, subprocess-stdin guards, git diff --check all clean.

Scope notes

• The prevention half of prune_stale_shallow_grafts() corrupts shallow checkouts: drops grafts still needed by reflog-only commits (regression of #105951's own fix, #108053) #108286 (keep reflog-reachable grafts in the prune) is owned by fix(cli): preserve reflog-reachable shallow grafts #108290; this PR is the repair half plus the minimal fail-safe fix that makes the two safe to combine.
• Fetch-by-SHA install tips (recorded only in HEAD's reflog) are documented as out of scope for repair: widening to HEAD's reflog would re-open the object-loss masking; new corruption of that shape is prevented by the prune's reflog fail-safe.

Fixes #108286. Based on #108361 by @JoaoMarcos44 (cherry-picked to preserve authorship).