fix(reliability): bound release-index Git metadata lookup on clean lineage

[seonghobae]

Controlled current-main replacement for #708

This is the clean-lineage replacement for stale/diverged Draft #708. It is based directly on protected main d2301dccb7d39a794d08cc96ea8c858b9ff49125 and carries only the already-proven release-index Git metadata timeout slice. #708 preserves the original fail-first history; its old-base checks/reviews do not transfer.

Production boundary

scripts/build_release_evidence_index.py::_source_commit participates in acquisition/release evidence generation. A hung git rev-parse HEAD must not stall that pipeline indefinitely.

This branch:

• defines one package-owned positive GIT_METADATA_TIMEOUT_SECONDS = 5 deadline;
• passes it to the exact Git metadata subprocess;
• catches subprocess.TimeoutExpired before the generic Git-unavailable fallback and fails closed with stable non-reflective RuntimeError("source commit lookup timed out");
• preserves the existing unknown fallback for ordinary non-timeout Git unavailability;
• adds the focused deterministic timeout regression; and
• adds one authoritative changelog fragment without rewriting unrelated release evidence.

No release-evidence schema, artifact digest, numerical code, dependency/workflow, version/release, provider/reviewer credential or canonical #604/#621 documentation change is included.

Verification boundary

Keep Draft until this unchanged head receives focused/full CI, Security Scan and SAST evidence against the current protected base, zero valid unresolved findings, and repository review/branch policy. The earlier #708 RED remains historical evidence only and is not treated as same-head acceptance.

Supersedes #708 after this replacement is opened and lineage is recorded.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 769accfa-5c45-451e-b5b3-3a26fd9a1f47

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing this temporary replacement because #708 moved concurrently during queue cleanup and is now itself reconciled directly onto protected main d2301dccb7d39a794d08cc96ea8c858b9ff49125 at head 88e307ebb9c55f70a585a9aa7183ff04920db87a, with the same three-path slice and preserved fail-first lineage. Keeping #715 would create a competing writer/duplicate merge path. No checks or review evidence transfer between the heads.