Complete Git version invalidation for packed refs, reftable, and nested archives #4186

User Story

I build OpenShell from linked worktrees and need the embedded version to follow the checkout that produced the binary. Unchanged inputs should stay fresh, while version-relevant ref and history changes should refresh the version.

Problem Statement

#4947 merged on 2026-10-30 and fixed the original common failure where a linked worktree's .git pointer file caused missing watched paths and repeated no-op rebuilds. That ordinary worktree failure is resolved on current main.

This issue now tracks the remaining follow-up in #3844:

• A checked-out branch can be packed, with no loose branch ref and no existing logs/HEAD at the first build. Watching only existing individual paths does not cover creation of its loose ref on the next update.
• Linked worktrees using Git's reftable backend have private and common ref tables. Shared branch/tag changes must invalidate the build even when HEAD is unchanged.
• A source archive nested inside a different tagged repository must keep the package version instead of discovering and adopting the enclosing repository's version.
• Changes to existing shallow-history metadata can affect the commit distance or reachable release tags without moving HEAD.

Impact / Why This Matters

Missed invalidation can leave a stale embedded version; archive ownership mistakes can identify the build using an unrelated repository. Correct freshness must be retained while covering these cases. The old warm-build timings are historical evidence for the pre-#4947 defect, not a measurement of the remaining follow-up or a claim that ordinary warm builds are still broken.

Acceptance Criteria

• Ordinary unchanged linked-worktree builds avoid the original missing-path invalidation (fix(core): resolve git rerun paths so worktree builds stay fresh #4947).
• A packed-to-loose checked-out branch update refreshes the embedded version when neither its loose ref nor its HEAD reflog existed at the first build.
• Linked reftable worktrees refresh after shared release-tag changes, including when HEAD stays fixed.
• A source archive with no .git of its own uses the package version, whether standalone or nested inside another repository.
• Existing shallow metadata changes are included among watched version inputs; unchanged inputs still reuse the previous build.
• Existing release-version selection and protobuf generation are preserved.

Reproduction Steps

Use isolated fixture repositories rather than changing contributor tags or refs:

1. For the packed-ref case, disable reflogs, pack the current branch, ensure its loose ref and HEAD reflog are absent, build, then move that branch without rewriting packed-refs. The next build must refresh the embedded SHA/version.
2. For reftable, create a linked worktree with that backend, build, then add a release tag through the common repository while HEAD stays fixed. The next build must report the new tag.
3. For archive ownership, place an unversioned source/probe archive inside a tagged repository. The archive must report its package version, not the parent's tag.

#3844 contains dependency-free Cargo probes using the production helper for these boundaries. Its packed-ref fixture disables reflogs and asserts that both the HEAD reflog and loose branch ref are absent before Cargo records its first inputs.

Suggested UX (if applicable)

No response

Environment

• Current-main baseline assessed: 42671c2dd2c02b744850e0bda72b99d5509969c1, including merged fix(core): resolve git rerun paths so worktree builds stay fresh #4947.
• Existing focused verification: macOS ARM64, Rust/Cargo 1.95.0 and reftable-capable Git as recorded with fix(core): complete Git version tracking for ref and archive edge cases #3844.
• This scope update introduces no new benchmark or cross-platform test claim.

Logs

The existing nested-archive negative control selected 0.1.0 from the enclosing fixture repository when the archive expected its package version 9.8.7. The earlier six-test Cargo probe receipt covers the unchanged production helper. After strengthening the packed-ref precondition, both affected packed-ref/reftable tests pass. Running the packed-ref regression against current main's unchanged Git-watch helpers fails with a stale 0.1.0 after the branch advances; the follow-up refreshes the version. The original missing .git/HEAD warm-build log predates #4947 and is retained only as historical context.