fix(harness-replays): use branch names in Compare API + correct nested file extraction

Bug 1 (SRE review): Gitea Compare API rejects SHA pairs (BaseNotExist).
Fix: use base.ref/head.ref (branch names) instead of base.sha/head.sha.
For push events: extract branch name from GITHUB_REF.

Bug 2 (SRE review): Python extraction looked at d.get('files', [])
which is always empty — Gitea nests files inside commits[*]['files'].
Fix: extract from nested commits structure via list comprehension.

SRE verified the fix works:
  GET /compare/main...fix/harness-replays-detect-changes-gitea-api
  → commits[0]['files']: ['.gitea/workflows/harness-replays.yml'] ✓

Co-Authored-By: SRE review via infra-sre agent

.gitea/workflows/harness-replays.yml

@@ -84,16 +84,21 @@ jobs:
             exit 0
           fi
 
-          # Determine base and head SHAs for the Compare API call.
-          # Pull request: base.sha + head sha are in the event payload.
-          # Push: github.event.before + github.sha.
+          # Determine base and head refs for the Compare API call.
+          # Gitea Compare API requires branch/tag names (SHAs return BaseNotExist).
+          # Pull request: base.ref + head.ref are in the event payload.
+          # Push: github.ref → extract branch name for the Compare API.
           if [ "${{ github.event_name }}" = "pull_request" ]; then
-            BASE="${{ github.event.pull_request.base.sha }}"
-            HEAD="${{ github.event.pull_request.head.sha }}"
+            BASE="${{ github.event.pull_request.base.ref }}"
+            HEAD="${{ github.event.pull_request.head.ref }}"
           elif [ -n "${{ github.event.before }}" ] && \
                ! echo "${{ github.event.before }}" | grep -qE '^0+$'; then
-            BASE="${{ github.event.before }}"
-            HEAD="${{ github.sha }}"
+            # Extract branch name from refs/heads/main -> main
+            BASE_REF="${GITHUB_REF#refs/heads/}"
+            BASE_REF="${BASE_REF:-main}"
+            HEAD_REF="${GITHUB_REF#refs/heads/}"
+            BASE="$BASE_REF"
+            HEAD="$HEAD_REF"
           else
             # New branch or github.event.before unavailable — run everything.
             echo "run=true" >> "$GITHUB_OUTPUT"
@@ -108,20 +113,17 @@ jobs:
           # (runbooks/gitea-operational-quirks.md §runner-network-isolation).
           #
           # API shape: GET /repos/{owner}/{repo}/compare/{base}...{head}
-          # Returns { files: [{filename}] } with all changed files.
+          # Returns { commits: [{ files: [{filename}] }] } — files are
+          # nested inside commits (Gitea quirk, not at top level).
           RESP=$(curl -sS --fail --max-time 30 \
             -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             -H "Accept: application/json" \
             "$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/compare/$BASE...$HEAD")
           DIFF_FILES=$(echo "$RESP" | python3 -c "
-import sys, json
-try:
-    d = json.load(sys.stdin)
-    files = d.get('files', [])
-    print('\n'.join(f['filename'] for f in files if 'filename' in f))
-except Exception:
-    # Malformed response — run everything as safe fallback
-    print('')
+import sys; import json
+d = json.load(sys.stdin)
+files = [f.get('filename','') for c in d.get('commits',[]) for f in c.get('files',[]) if f.get('filename')]
+print('\n'.join(files))
 " 2>/dev/null || true)
 
           echo "debug=diff-base=$BASE diff-files=$DIFF_FILES" >> "$GITHUB_OUTPUT"