C7: discover does a full-history checkout it no longer needs

[Strycher]

_{Recreated from Strycher/Field_Compass-archive#239 — originally opened by @Strycher on 2026-09-07. Credentials redacted where present.}

Epic: #155
Feature: #217

Raised by the adversarial review on #223 (gemini-2.5-pro, Low severity) and filed rather than folded in, since it is C1's code and not part of that change.

discover checks out with fetch-depth: 0 — full history — so that the change-detection step can diff a PR against its base.

Two things have changed since that was written:

1. C3: verify the gate actually blocks, then decide required vs advisory #223 replaced the detection method. It now uses github.event.pull_request.base.sha and head.sha directly, following CoreScope-OKI's changes job, instead of git fetch origin <base_ref> plus a three-dot diff. So the extra fetch the review flagged is already gone.
2. The build job no longer shares this checkout. It does its own.

What remains unverified is whether fetch-depth: 0 is still needed at all, or whether a shallow checkout can reach base.sha. The detector defaults to firmware=true when the base sha is unreachable, so getting this wrong fails safe — it costs a full build, not a false pass. That is exactly why it is worth measuring rather than guessing: the failure is invisible.

Acceptance

• Measured: how long fetch-depth: 0 actually takes on this repo, so the saving is known before optimising
• Determined by an actual run whether a shallow checkout can resolve base.sha for a PR, including a PR whose base branch has moved on
• If shallow works, the change lands with evidence that docs-only detection still returns false correctly and firmware detection still returns true
• If it does not work, that is recorded here and the issue closes as won't-fix rather than staying open

Not urgent

Pure runner-time optimisation on a job that takes seconds. Behind #222 (caching), which addresses the minutes.