fix(ci): TypeScript Type Check 走 merge base，补上缺失的 fetch-depth: 0 (#6359)

`lint.yml` 的 `typecheck` job 用 `actions/checkout@v7` 的默认 `fetch-depth: 1`，
于是 `resolveSurfaceBase()` 里的 `merge-base HEAD origin/main` 在这个 job 里
永远走不通，每次都落到 origin/main 的 tip。而合并 ref 随 main 前进而陈旧，
tip != merge base，「main 新增的键」就被读成「本 PR 删掉的键」——方向恰好反了。

同文件的 ESLint job 已有同一句 `fetch-depth: 0`，但失效方向不同：那道门
shallow 时降级为不校验（假绿），这道门 shallow 时降级为误报红。

一并把 shallow 那行日志从「静默降级说明」改成点名方向的诊断：tip 锚下
main 新增 == 本分支删除，且若在 CI 则该 job 的 checkout 需要 fetch-depth: 0。
判决逻辑一行未动；把 fallback 本身显式化的那一半爆炸半径过大，拆到 #6452。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BDmDsu2575gDxeMCxXhDE3

Author: claude

.github/workflows/lint.yml

@@ -489,6 +489,22 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
+        with:
+          # The authorable-surface deletion gate (#4650) below anchors on the
+          # MERGE BASE of HEAD with origin/main — that is the only anchor under
+          # which "a key this PR deleted" and "a key main gained since the fork
+          # point" are different facts. A shallow clone has no walkable
+          # ancestry, so `merge-base` fails and the gate falls back to
+          # origin/main's TIP, where those two facts collapse into one and the
+          # SECOND one is reported as the first: #6359 had PR #6356 (which
+          # touches no spec file at all) go red for "deleting"
+          # ui/BulkActionDef:requiredPermissions — a key main had just ADDED.
+          #
+          # Same line as the ESLint job above, opposite failure mode, and that
+          # is why it is spelled out here rather than cross-referenced: shallow
+          # degrades the slot-lookup ratchet to "not verified" (a false GREEN),
+          # and degrades this gate to a false RED on an innocent PR.
+          fetch-depth: 0
 
       - name: Setup Node.js
         uses: actions/setup-node@v7

packages/spec/scripts/build-schemas-check-mode.test.ts

@@ -1517,7 +1517,9 @@ describe('build-schemas.ts — the drift notice names the direction it measured
       // Truncation moves TWO things here, and the second was a surprise worth
       // writing down: `merge-base HEAD origin/main` itself fails once the walk is
       // cut, so `resolveSurfaceBase` falls back to origin/main's TIP as the
-      // baseline (it says so — "using origin/main tip … as the baseline anchor").
+      // baseline (it says so — "no merge base is walkable here, so this run
+      // anchors on the origin/main TIP …", the line #6359 reworded to name what
+      // that anchor then MISJUDGES).
       // The pair being compared is therefore anchor-at-`tip` vs baseline-at-
       // `mainTip`, not the fork point at all. And the ancestry between them is
       // exactly what a grafted history cannot answer: `mainTip` is its own shallow

packages/spec/scripts/build-schemas.ts

@@ -1509,8 +1509,17 @@ function resolveSurfaceBase(): SurfaceBaseResolution | null {
   const git = gitInPackage;
   const committed = readCommittedSurfaceBase();
 
-  // CI's typecheck job checks out shallow with no branch refs, so fetch the
-  // one ref this check needs (depth 1 — a single snapshot) before giving up.
+  // A checkout with no branch refs (any `fetch-depth: 1` job) cannot name
+  // origin/main at all, so fetch the one ref this check needs before giving up.
+  //
+  // This fetch is GUARDED by the probe above and that is load-bearing (#6359):
+  // where the ref already resolves — every full clone, and every CI job that
+  // checks out `fetch-depth: 0` — it does not run, so it cannot undo the depth
+  // its job asked for. Where it does run, it is `--depth=1` because the only
+  // thing it is trying to buy is the ability to NAME origin/main; deepening it
+  // here would silently make every shallow build pay for a full history it was
+  // configured not to want. The job that needs walkable ancestry declares that
+  // in its checkout step, which is where the cost is visible.
   let tipProbe = git('rev-parse', '--verify', '--quiet', 'origin/main^{commit}');
   if (tipProbe.status !== 0) {
     git('fetch', '--quiet', '--depth=1', 'origin', '+refs/heads/main:refs/remotes/origin/main');
@@ -1526,7 +1535,29 @@ function resolveSurfaceBase(): SurfaceBaseResolution | null {
     const mergeBase = git('merge-base', 'HEAD', tip);
     const rev = mergeBase.status === 0 ? mergeBase.stdout.trim() : tip;
     if (mergeBase.status !== 0) {
-      console.log(`   (shallow history — using origin/main tip ${tip.slice(0, 12)} as the baseline anchor)`);
+      // That "…is the merge base anyway" holds only while the merge ref is
+      // fresh. It is generated when the PR opens or updates and goes STALE as
+      // main advances, so on a branch that forked earlier the tip anchor
+      // carries keys the fork point never had — and this gate reads every one
+      // of them as a line THIS commit deleted. The direction is worth spelling
+      // out because the verdict it produces ("deleted without proof") reads
+      // like a severe spec violation and costs far more to diagnose than to
+      // fix: #6359 was one CI job missing `fetch-depth: 0`, and the PR it
+      // reddened (#6356) had not touched packages/spec at all.
+      //
+      // Diagnostic only — the verdict below is unchanged. Making this route
+      // stop MISJUDGING rather than merely announcing itself is a separate
+      // decision with a much wider blast radius: this block is top-level, so
+      // every `gen:schema` runs it, which means every shallow job that builds
+      // @objectstack/spec (ci.yml `build-core`, docker-publish, release, …)
+      // takes this path whenever that build is a cache miss. Tracked in #6452.
+      console.log(
+        `   (shallow history — no merge base is walkable here, so this run anchors on the\n` +
+          `    origin/main TIP ${tip.slice(0, 12)} instead. ⚠️  Under a tip anchor a key that main ADDED\n` +
+          `    after this branch forked is indistinguishable from a key this branch DELETED. If a\n` +
+          `    deletion is reported below for a file you did not touch, check that first — and if\n` +
+          `    this is CI, the job's checkout step needs \`fetch-depth: 0\` (#6359).)`,
+      );
     }
     const baseline = readSurfaceKeysAtRev(
       git,