feat(installer): make commit pinning opt-in, default to branch-follow

[jquesnelle]

The bootstrap installer's build.rs unconditionally baked a commit pin via git rev-parse HEAD, forcing every dev build to clone an exact SHA at install time. That SHA had to be pushed to origin or the fresh-box clone would fail.

Make the commit pin opt-in: by default build.rs bakes ONLY the detected branch, so the installer follows that branch's HEAD at install time. Set HERMES_BUILD_PIN_COMMIT (SHA, tag, or branch name) to bake an immutable commit pin for reproducible/release builds; it is resolved to a SHA via git rev-parse --verify <ref>^{commit} and fails loud on an unresolvable ref. Runtime resolution already supported branch-only pins, so no changes needed in bootstrap.rs / install_script.rs / install.ps1.

[github-actions]

🔎 Lint report: installer-optional-commit-pin vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9600 on HEAD, 9600 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 4976 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[Copilot]

Pull request overview

This PR updates the bootstrap installer’s Tauri build.rs so commit pinning is opt-in (via HERMES_BUILD_PIN_COMMIT) and dev builds default to baking only a branch pin, allowing the produced installer to follow the branch HEAD at install time.

Changes:

• Make HERMES_BUILD_PIN_COMMIT the sole trigger for baking a commit SHA; otherwise emit no commit pin.
• Resolve HERMES_BUILD_PIN_COMMIT refs to an immutable SHA via git rev-parse --verify <ref>^{commit}, failing loudly when unresolvable (unless it already looks like a SHA).
• Improve build-time warnings to distinguish “pinning branch” vs “following branch HEAD”.

Comments suppressed due to low confidence (1)

apps/bootstrap-installer/src-tauri/build.rs:58

• The inline comment says we "Fail loudly" when neither commit nor branch resolves, but the code only emits a cargo warning and continues. This is confusing. Either change the behavior to panic, or update the comment to match the current behavior (warn and allow the build to proceed).

        // Fail loudly rather than silently produce a binary that errors
        // at runtime with "no install-script pin supplied". A build that
        // can't resolve a pin almost certainly indicates a misconfigured
        // build environment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.