[Buildkite] Fix fork PR builds: require full SHA, drop Events API gate

[pickypg]

Problem

PR #1044 added a push-time gate that queries the Events API to prove a commit predates the trigger comment. This broke the fork-PR support added in #1019: GET /repos/<fork>/events always returns [] for fork repositories — even when the fork is active and pushed_at reflects a recent push.

The result is that every attempt to build a fork PR (like #1045) hits the fail-closed branch and exits 1:

No push event found for eac2822… in kunisen/support-diagnostics. The push may not be indexed yet or is outside the events window. Please re-comment once the push is visible.

A secondary issue (#1044's case "$REQUESTED"\* prefix match): when the "Update branch" button creates a merge commit, the new HEAD SHA doesn't appear in the PR's commit list. Maintainers see 2ae8498 as the tip and use that, but the actual head is eac2822…. The error message printed the head SHA but gave no copy-paste hint.

Fix

Require the full 40-character SHA instead of ≥7 chars.

A full 40-char SHA is content-addressed: naming it and verifying it equals the live PR head at workflow-resolution time pins the exact tree that gets built. A commit pushed after the comment has a different SHA and fails the head-match check — the push-time gate was only closing the abbreviated-SHA collision window (7 hex chars ≈ 28 bits, brute-forceable). Eliminating short prefixes removes that window entirely, making the Events API check redundant.

Changes:

• Regex tightened from {7,40} to exactly {40} with a trailing non-hex/end-of-string anchor
• case "$REQUESTED"\* prefix match replaced with [ "$HEAD_SHA" != "$REQUESTED" ] exact equality
• Mismatch error now includes a copy-paste re-comment hint with the correct head SHA
• PUSHED_AT retry loop and all Events API code removed (also eliminates the --paginate | head -n1 SIGPIPE hazard and the 3 × sleep 10 30-second penalty on every failure)
• HEAD_REPO_FULL removed from the read -r / --jq tuple (was only used by the deleted block)
• Header comment updated to say "full 40-character commit SHA"
• Explanatory comment left in place of the deleted block recording why there is no Events API check

Verification

1. Merge to main (issue_comment workflows run from the default branch).
2. On PR [Stack] Clarify the diagnostics capture impact #1045, comment buildkite test this eac2822408d301a60cb89174a47f854550367236 (re-read current head first with gh pr view 1045 --json headRefOid).
3. Confirm the run succeeds and a Buildkite build appears for refs/pull/1045/head.
4. Negative: comment a 7-char prefix — confirm it's rejected with "FULL 40-character commit hash".

🤖 Generated with Claude Code