diff-scope: fail-safe auth match; resolveBase never re-qualifies a remote-qualified base (GST-1065, GST-1036)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/diff-scope.test.ts

@@ -238,7 +238,8 @@ describe('gstack-diff-scope', () => {
   for (const file of ['src/auth.ts', 'app/auth/login.rb', 'lib/oauth.ts', 'src/oauth2/token.ts', 'lib/authn/check.go', 'src/authz.py', 'src/authService.ts',
     'src/useAuth.ts', 'lib/OAuthClient.ts', 'lib/authentication.rb', 'lib/authorization_policy.rb', 'src/Authorize.tsx', 'config/AUTH_KEYS.md', 'pkg/auth-middleware.go',
     'lib/auth0.ts', 'src/basicauth.go', 'src/authguard.ts', 'lib/reauth.ts', 'pages/api/nextauth.ts', 'src/authtoken.ts', 'lib/preauth.rb', 'src/HTTPAuth.ts',
-    'src/unauthenticated.ts', 'lib/reauthentication.ts', 'src/deauthorize.ts', 'app/oauth2client.py', 'api/HTTPAuthorization.ts']) {
+    'src/unauthenticated.ts', 'lib/reauthentication.ts', 'src/deauthorize.ts', 'app/oauth2client.py', 'api/HTTPAuthorization.ts',
+    'src/nextauthmiddleware.ts', 'src/reauthn.ts', 'src/noauthrequired.ts']) {
     test(`${file} is an auth path`, () => {
       expect(runScope(createRepo([file])).SCOPE_AUTH).toBe('true');
     });

test/stale-local-base.test.ts

@@ -11,6 +11,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { BANNED_TERMS_SCHEMA } from '../lib/banned-terms';
+import { resolveBase } from '../lib/gate-diff/git';
 import { resolveCommit } from '../lib/pr-shots';
 
 const BIN = path.join(import.meta.dir, '..', 'bin');
@@ -101,6 +102,16 @@ describe('a bare --base reads origin/<base> over a stale local branch (GST-1036)
     expect(r.err).toContain(`gstack-docs-candidate: ${NOTE}`);
   }, 120_000);
 
+  // Value: protects=a remote-qualified base is never re-qualified: origin/main reads refs/remotes/origin/main or nothing;
+  //   fails_when=resolveBase falls through to refs/remotes/origin/origin/main when the tracking ref is missing; why_new=GST-1036 review (#3852 rule); seam=lib/gate-diff/git.ts resolveBase
+  test('resolveBase never re-qualifies origin/main when refs/remotes/origin/main is missing', () => {
+    const { work, sh, origin } = fixture();
+    expect(resolveBase('origin/main', work, 'HEAD')?.sha).toBe(origin);
+    sh(work, 'git update-ref refs/remotes/origin/origin/main HEAD && git update-ref -d refs/remotes/origin/main');
+    expect(resolveBase('origin/main', work, 'HEAD')).toBeNull();
+    expect(resolveBase('main', work, 'HEAD')?.ref).toBe('main');
+  }, 120_000);
+
   // Value: protects=the PR screenshot's before side is origin's base, not a stale local copy; fails_when=resolveCommit reads refs/heads/main first;
   //   why_new=GST-1036 sibling bin; seam=lib/pr-shots.ts resolveCommit
   test('gstack-pr-shots --base main reads origin/main; a sha resolves as given', () => {