Fix post-merge exact-head validation

[hudsonaikins]

Summary

• validate pull-request heads against origin/main
• validate landed push commits against HEAD^
• preserve exact landed-commit evidence without producing an empty checkpoint range

Validation

• reproduced the landed failure at c4789837: empty HEAD..HEAD checkpoint range
• exact hotfix commit: d5a81393dabc6c52c88dd6f37a5b30267b471022
• 98/98 tests passed outside the restricted sandbox
• local product gate reached all validators; only loopback-listener tests were blocked by the local sandbox
• GitHub exact-head product validation is authoritative

Rollout boundary

Merge authorized. No deployment.

[hudsonaikins]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5a81393da

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Retain the checkpoint in the narrowed push range

For the push event generated by this reviewed commit, setting the base to HEAD^ narrows checkpoint discovery to 5e9a0d3^..5e9a0d3, but this commit has no Entire-Checkpoint trailer. Because tabellio.validation.json sets requireEntireCheckpoint to true, ValidationRunner.run finds an empty checkpoint list and throws before running any validators, so the exact-head validation this patch is intended to repair still fails for its own pushed SHA.

Useful? React with 👍 / 👎.