fix(triage): compute the flake-gate diff before the env -i re-exec

.github/scripts/qwen-triage-workflow.test.mjs

@@ -1014,14 +1014,19 @@ describe('qwen-triage: flakiness gate (#9125)', () => {
     // executes, so it is a changed test file exactly like M.
     assert.match(
       recordStep.run,
-      /^\s*git -c core\.quotePath=false diff -z --name-only --diff-filter=ACMRT "\$BASE_OID" HEAD \\\n\s*> "\$GATE_HOME\/files-all"$/m,
+      /^\s*git -c core\.quotePath=false diff -z --name-only --diff-filter=ACMRT "\$BASE_OID" HEAD \\\n\s*> "\$\{RUNNER_TEMP:\?\}\/flake-record-files-all"$/m,
       'the NUL diff must flow straight into its file — $( ) strips NUL bytes, a pipeline swallows the exit status',
     );
     assert.match(
       recordStep.run,
       /^\s*BASE_OID="\$\(cat "\$\{RUNNER_TEMP:\?\}\/verify-base-oid"\)"$/m,
       'the record step must diff against the base OID captured while .git was root-owned, not re-resolve HEAD^1',
     );
+    assert.match(
+      recordStep.run,
+      /^\s*cp "\$\{RUNNER_TEMP:\?\}\/flake-record-files-all" "\$GATE_HOME\/files-all"$/m,
+      'the scrubbed child must copy the parent-recorded diff, never re-run git under env -i',
+    );
     assert.ok(
       recordStep.run.includes(
         "grep -zE '\\.(test|spec)\\.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$'",

.github/workflows/qwen-triage.yml

@@ -2903,6 +2903,24 @@ jobs:
                 /usr/bin/printf '::error::flake-gate record: step script changed between open and re-exec snapshot — refusing to run\n'
                 exit 1
               fi
+              # Record the changed-test list in the PARENT's normal environment,
+              # before the env -i re-exec: the scrubbed child cannot read the
+              # shallow merge-ref objects — git's `safe.directory` global config
+              # lives under HOME, which `env -i` strips, so git refuses to read
+              # the base commit object and the diff fails with
+              # "Could not access <base-oid>". The diff reads git metadata only
+              # and executes no PR code, so running it here is safe, and the
+              # "Pin agent inputs" step already proved this environment reads
+              # the base. Write the NUL-delimited list under RUNNER_TEMP, which
+              # the re-exec forwards; the clean child copies it into the gate
+              # home below.
+              BASE_OID="$(cat "${RUNNER_TEMP:?}/verify-base-oid")"
+              case "$BASE_OID" in
+                [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]*) ;;
+                *) echo "::error::No trusted base OID recorded; refusing to record the flakiness-gate file list."; exit 1 ;;
+              esac
+              git -c core.quotePath=false diff -z --name-only --diff-filter=ACMRT "$BASE_OID" HEAD \
+                > "${RUNNER_TEMP:?}/flake-record-files-all"
               LD_PRELOAD= LD_AUDIT= LD_LIBRARY_PATH= exec /usr/bin/env -i \
                 PATH="$PATH" RUNNER_TEMP="${RUNNER_TEMP:-}" \
                 GITHUB_OUTPUT="${GITHUB_OUTPUT:-}" GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-}" \
@@ -2975,21 +2993,11 @@ jobs:
           # T (typechange) included: a symlink->regular flip changes what
           # the runner executes, so it is a changed test file exactly
           # like M — excluding it silently drops the file from the gate.
-          # Diff against the base OID the "Pin agent inputs" step recorded
-          # while .git was still root-owned, never `HEAD^1` again: this
-          # step runs in the env -i scrubbed child, and resolving the `^1`
-          # parent there intermittently fails with "Could not access
-          # 'HEAD^1'" on the persistent pool — the shallow merge-ref object
-          # store is left in a state prior --depth=2 fetches made
-          # unreadable. The OID is content-addressed and needs no parent
-          # walk, so the diff works from the already-captured value.
-          BASE_OID="$(cat "${RUNNER_TEMP:?}/verify-base-oid")"
-          case "$BASE_OID" in
-            [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]*) ;;
-            *) echo "::error::No trusted base OID recorded; refusing to record the flakiness-gate file list."; exit 1 ;;
-          esac
-          git -c core.quotePath=false diff -z --name-only --diff-filter=ACMRT "$BASE_OID" HEAD \
-            > "$GATE_HOME/files-all"
+          # The diff was already computed in the parent (before the env -i
+          # re-exec, where git can read the shallow merge-ref objects) and
+          # staged under RUNNER_TEMP; this scrubbed child only copies it
+          # into the root-only gate home.
+          cp "${RUNNER_TEMP:?}/flake-record-files-all" "$GATE_HOME/files-all"
           # .mts/.cts included: vitest's default include set collects them.
           # Only a no-match (status 1) may yield an empty list: a grep
           # error (status 2, e.g. ENOSPC opening the output) is