fix(ci/harness-replays): fetch base branch tip explicitly instead of full history

Previous attempt used fetch-depth:0 on actions/checkout, but the 75 MB
repo full-history fetch times out on the operator-host runner network
(github.com unreachable, apt mirrors ~3s timeout). A full history fetch
also takes >1m18s even when it doesn't fail.

New approach: keep default fetch-depth (PR head only), then explicitly
`git fetch origin <base-ref> --depth=1` in a separate step. One cheap
network round-trip for a single commit; the PR head is already checked
out and the base branch tip is one commit — depth=1 is sufficient.

Spotted during gate triage review (core-lead-agent, 2026-05-11).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/harness-replays.yml

@@ -68,17 +68,18 @@ jobs:
       run: ${{ steps.decide.outputs.run }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # fetch-depth: 0 is required here. The step runs `git diff "$base_sha"
-          # "$head_sha"` — if only the head commit is fetched (default
-          # fetch-depth: 1), the base ref is not in the local history and
-          # git diff fails silently (2>/dev/null), leaving DIFF empty, the
-          # step exits non-zero, and detect-changes reports "failure" despite
-          # continue-on-error: true. With fetch-depth: 0 the full history is
-          # available so both refs exist locally. The PR head and the base
-          # branch tip are always on the remote; full history is needed only
-          # to make them accessible offline in the container.
-          fetch-depth: 0
+      - name: Fetch base branch tip for diff
+        run: |
+          # With the default fetch-depth: 1, actions/checkout only fetches the
+          # PR head commit. The base branch tip (github.event.pull_request.base.sha)
+          # is NOT in the local history, so `git diff "$BASE" "$GITHUB_SHA"` fails
+          # because neither ref is fully resolved. Fetch only the base branch at
+          # depth 1 — one cheap network round-trip, sufficient for diff.
+          #
+          # Do NOT use fetch-depth: 0 here — the repo is 75+ MB and a full history
+          # fetch times out on the operator-host runner network (github.com unreachable,
+          # ~3s timeout to apt mirrors). A single-commit fetch avoids that.
+          git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
       - id: decide
         run: |
           # workflow_dispatch: always run (manual trigger)