fix(ci): first-live-run fixes — executor history + two environment-blind assertions

The sliced lane's first run (PR #2721) did its job: the planner and
report worked, the manifest governed, and every failure had a name.
Three were fixable on the spot:

- executor + gate-census checkouts get fetch-depth: 0 — files with
  SELF-derived selection (the LLM-judge map, routing) walk git at
  module load, and selection is deliberately fail-closed on git errors,
  so the shallow checkout crashed those shards ('ambiguous argument
  main...HEAD'). The manifest still governs WHICH shards run.
- landscape --toc gate: the exact toBe(3) landscape-page count was
  font-metric-dependent (3 on Amazon Linux, 2 on ubuntu CI — the same
  disease the file's own page-index comment warns about). Now a
  comparative invariant: --toc must not CHANGE the landscape count vs
  a baseline render.
- paid-run-manifest parse test builds its manifest under EVALS_ALL so
  it never walks git (proven with GIT_DIR=/nonexistent).

Remaining first-run failures are newly-exposed rot in gate files that
had never executed in CI (skillify D1 refusal, session-intelligence
context-restore, one tpa-apple-ban retry flake) — being probed
separately; they are the lane WORKING, not the lane failing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/evals-periodic.yml

@@ -135,6 +135,12 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          # Full history: files with SELF-derived selection (the LLM-judge
+          # map, routing) walk git at module load, and selection is
+          # fail-closed on git errors — a shallow checkout crashed those
+          # shards on the lane's first live run ("ambiguous argument
+          # 'main...HEAD'"). The manifest still governs WHICH shards run.
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Fix bun temp
@@ -257,6 +263,12 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          # Full history: files with SELF-derived selection (the LLM-judge
+          # map, routing) walk git at module load, and selection is
+          # fail-closed on git errors — a shallow checkout crashed those
+          # shards on the lane's first live run ("ambiguous argument
+          # 'main...HEAD'"). The manifest still governs WHICH shards run.
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Fix bun temp

.github/workflows/evals.yml

@@ -568,6 +568,12 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          # Full history: files with SELF-derived selection (the LLM-judge
+          # map, routing) walk git at module load, and selection is
+          # fail-closed on git errors — a shallow checkout crashed those
+          # shards on the lane's first live run ("ambiguous argument
+          # 'main...HEAD'"). The manifest still governs WHICH shards run.
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Fix bun temp

make-pdf/test/e2e/landscape-gate.test.ts

@@ -111,10 +111,19 @@ describe("landscape promotion gate", () => {
     if (!avail.ok) return;
     const workDir = fs.mkdtempSync("/tmp/make-pdf-landscape-toc-");
     const outputPdf = path.join(workDir, "out.pdf");
+    const baselinePdf = path.join(workDir, "baseline.pdf");
     try {
+      // Comparative invariant, not an exact count: whether a wide table
+      // spills onto an extra landscape page depends on font metrics (the
+      // fixed `toBe(3)` passed on Amazon Linux and failed on ubuntu CI with
+      // 2 — the same disease the page-index comment above warns about).
+      // What --toc must not do is CHANGE the landscape promotion outcome.
+      generate([], baselinePdf);
+      const baselineLandscape = pageBoxes(baselinePdf).filter(isLandscape).length;
+      expect(baselineLandscape).toBeGreaterThanOrEqual(1);
       generate(["--toc"], outputPdf);
       const boxes = pageBoxes(outputPdf);
-      expect(boxes.filter(isLandscape).length).toBe(3);
+      expect(boxes.filter(isLandscape).length).toBe(baselineLandscape);
 
       const pdftotext = resolvePopplerTool("pdftotext")!;
       const text = execFileSync(pdftotext, [outputPdf, "-"], { encoding: "utf8", timeout: CHILD_TIMEOUT_MS });

test/paid-run-manifest.test.ts

@@ -68,7 +68,11 @@ describe('run manifest (planner)', () => {
   });
 
   test('parse round-trips and rejects malformed manifests', () => {
-    const manifest = buildRunManifest({ tier: 'gate', sliceCount: 2, evalsAll: false, env: {} });
+    // EVALS_ALL short-circuits diff selection BEFORE any git walk: selection
+    // is deliberately fail-closed on git errors, and CI's shallow free-tests
+    // checkout has no base ref (first CI run failed here with
+    // "ambiguous argument 'main...HEAD'").
+    const manifest = buildRunManifest({ tier: 'gate', sliceCount: 2, evalsAll: false, env: { EVALS_ALL: '1' } });
     expect(parseRunManifest(JSON.stringify(manifest))).toEqual(manifest);
     expect(() => parseRunManifest('{}')).toThrow(/version/);
     expect(() => parseRunManifest(JSON.stringify({ ...manifest, tier: 'e2e' }))).toThrow(/tier/);