fix(ci): repair the fallow workflow

.fallowrc.json

@@ -5,7 +5,8 @@
     "**/coverage/**",
     "**/storybook-static/**",
     "**/*.generated.ts",
-    "patches/**"
+    "patches/**",
+    "examples/**"
   ],
   "ignoreDependencies": ["expo-splash-screen", "expo-sqlite"],
   "dynamicallyLoaded": [

.github/workflows/fallow.yml

@@ -52,20 +52,50 @@ jobs:
             echo "ref=origin/main" >> "$GITHUB_OUTPUT"
           fi
 
+      # Temporary diagnostic: exercise the exact git operation fallow's
+      # base-snapshot pass performs, with stderr visible in the log.
+      - name: Probe git worktree creation
+        shell: bash
+        run: |
+          set -x
+          git --version
+          git rev-parse --verify "${{ steps.base.outputs.ref }}"
+          git config core.hooksPath || true
+          df -h /tmp | tail -1
+          git worktree add --detach "$RUNNER_TEMP/fallow-probe" "${{ steps.base.outputs.ref }}" && echo "PROBE OK"
+          git worktree remove --force "$RUNNER_TEMP/fallow-probe" || true
+
       - name: Run Fallow audit
         shell: bash
         run: |
           pnpm exec fallow audit \
             --changed-since "${{ steps.base.outputs.ref }}" \
             --format sarif \
-            --fail-on-issues \
-            --quiet > fallow-audit.sarif
+            --fail-on-issues > fallow-audit.sarif
+
+      # CodeQL's upload action rejects SARIF files that contain multiple runs
+      # under one category, and fallow emits one run per sub-analysis — this
+      # is why every upload failed before. Merge the runs (same driver) into
+      # one. Producing the .single.sarif file only when the input parses also
+      # guards against the empty file a crashed audit leaves behind, which
+      # passes hashFiles() but is not valid JSON.
+      - name: Normalize Fallow SARIF to a single run
+        if: always()
+        shell: bash
+        run: |
+          if jq -e '.runs | length >= 1' fallow-audit.sarif > /dev/null 2>&1; then
+            jq 'if (.runs | length) > 1 then
+                  .runs[0].results = ([.runs[].results // []] | add) |
+                  .runs[0].tool.driver.rules = ([.runs[].tool.driver.rules // []] | add | unique_by(.id)) |
+                  .runs = [.runs[0]]
+                else . end' fallow-audit.sarif > fallow-audit.single.sarif
+          fi
 
       - name: Upload Fallow SARIF
-        if: always() && hashFiles('fallow-audit.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@v3
+        if: always() && hashFiles('fallow-audit.single.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          sarif_file: fallow-audit.sarif
+          sarif_file: fallow-audit.single.sarif
           category: fallow-audit
 
       - name: Run Fallow dead-code regression