CI calibration ancestry check depends on deleted PR refs

[prekshivyas]

Summary

The full-E2E cold-path calibration test requires every recorded testedSha to exist in a fresh local Git checkout. Some recorded revisions are PR-only commits, so the test starts failing after the source PR merges and its refs disappear even though actions/checkout uses fetch-depth: 0.

This blocks unrelated code PRs before the trusted E2E gate can dispatch.

Current failure

PR #8021 CI run 30653373482 failed in cli-test-shards (3):

Error: git merge-base could not verify calibration ancestry; ensure the checkout has full history (status 128): fatal: Not a valid commit name 915b25c522d982fc7d40d01e583bc8f15bcf975f

• Failed job: https://github.com/NVIDIA/NemoClaw/actions/runs/30653373482/job/91231809262
• The aggregate cli-tests, checks, and trusted PR E2E gate failed only as consequences.

Evidence

• PR test(e2e): calibrate restart-safe startup budget #7999 added restartSafeStartupAdjustment and local ancestry checks for both workflowHeadSha and testedSha.
• Recorded SHA 915b25c522d982fc7d40d01e583bc8f15bcf975f is a two-parent commit associated with PR perf(e2e): move recovery repetition into integration tests #7942, not an ancestor reachable from current main.
• PR perf(e2e): move recovery repetition into integration tests #7942 merged at 2026-07-31 17:51 UTC. The same fix(snapshot): stabilize pending pairing publication #8021 code suite passed before that merge, then failed from a fresh checkout after it.
• GitHub's commit API still resolves the immutable object, but a clean fetch-depth: 0 checkout does not fetch unadvertised deleted-PR objects.
• The calibration also records d1b24c97c348215574fd8c55435a2e8c5e0d86e1 from the same PR and c3106eea0669aa645c0ff6f51adce0badf24477f from now-merged PR fix(hermes): support legacy gateway image builds #7989, so fixing only the first missing SHA would leave the next latent failure.

Expected behavior

Deterministic repository tests must pass in a fresh full-history checkout after evidence-source PRs merge. Calibration provenance should remain bound to exact run and tested revision receipts without requiring deleted PR refs to remain advertised forever.

Acceptance criteria

• A fresh checkout of current main passes test/onboard-performance-config-schema.test.ts without fetching PR refs or making network calls from the test.
• Durable workflowHeadSha and runtime-input ancestry checks remain enforced.
• Exact testedSha, run ID, job ID, and run URL receipt validation remains enforced without assuming each tested commit is locally reachable.
• Coverage proves a PR-only tested revision cannot break unrelated CI after its source ref disappears.