Keep build versions accurate after Git changes and in source archives #4186

User Story

I build OpenShell from linked worktrees and source archives. I need the binary to report the version of the source that produced it. Relevant Git changes should refresh that version, while unchanged inputs should reuse the previous build.

Problem Statement

#4947 merged on 2026-10-30 and fixed the ordinary linked-worktree problem where the .git pointer file led to missing watched paths and repeated no-op rebuilds. That original problem is resolved on current main.

This issue tracks the remaining cases in #3844:

• Packed branch refs: when neither a loose branch ref nor logs/HEAD exists at the first build, watching only existing files can miss the loose ref created by the next branch update.
• Reftable worktrees: Git can store refs in private and shared tables. Shared branch or release-tag changes must refresh the version even when HEAD stays unchanged.
• Nested source archives: an archive without its own .git must use the package version, even when built inside another tagged repository.
• Shallow history: changes to existing shallow-history metadata can affect commit distance or reachable release tags without moving HEAD.

Impact / Why This Matters

A binary can report a stale version or a version taken from an unrelated enclosing repository, making it harder to identify the source behind a deployment.

The fix must cover these remaining cases while preserving reuse of unchanged builds. The old warm-build timings describe the defect fixed by #4947; they do not measure this follow-up or show that ordinary warm builds are still broken.

Acceptance Criteria

• Ordinary unchanged linked-worktree builds avoid the original missing-path invalidation (fix(core): resolve git rerun paths so worktree builds stay fresh #4947).
• A packed-to-loose checked-out branch update refreshes the embedded version when neither its loose ref nor its HEAD reflog existed at the first build.
• Linked reftable worktrees refresh after shared release-tag changes, including when HEAD stays fixed.
• A source archive with no .git of its own uses the package version, whether standalone or nested inside another repository.
• Existing shallow metadata changes are included among watched version inputs; unchanged inputs still reuse the previous build.
• Existing release-version selection and protobuf generation are preserved.

Reproduction Steps

Use isolated fixture repositories rather than changing contributor tags or refs:

1. For the packed-ref case, disable reflogs, pack the current branch, ensure its loose ref and HEAD reflog are absent, build, then move that branch without rewriting packed-refs. The next build must refresh the embedded SHA/version.
2. For reftable, create a linked worktree with that backend, build, then add a release tag through the common repository while HEAD stays fixed. The next build must report the new tag.
3. For archive ownership, place an unversioned source/probe archive inside a tagged repository. The archive must report its package version, not the parent's tag.

#3844 contains dependency-free Cargo probes using the production helper for these boundaries. Its packed-ref fixture disables reflogs and asserts that both the HEAD reflog and loose branch ref are absent before Cargo records its first inputs.

Suggested UX (if applicable)

No response

Environment

• Current-main baseline assessed: 42671c2dd2c02b744850e0bda72b99d5509969c1, including merged fix(core): resolve git rerun paths so worktree builds stay fresh #4947.
• Existing focused verification: macOS ARM64, Rust/Cargo 1.95.0 and reftable-capable Git as recorded with fix(core): complete Git version tracking for ref and archive edge cases #3844.
• This scope update introduces no new benchmark or cross-platform test claim.

Logs

The existing nested-archive negative control selected 0.1.0 from the enclosing fixture repository when the archive expected its package version 9.8.7. The earlier six-test Cargo probe receipt covers the unchanged production helper. After strengthening the packed-ref precondition, both affected packed-ref/reftable tests pass. Running the packed-ref regression against current main's unchanged Git-watch helpers fails with a stale 0.1.0 after the branch advances; the follow-up refreshes the version. The original missing .git/HEAD warm-build log predates #4947 and is retained only as historical context.