fix(pm-tooling): refuse windowed history questions a shallow clone cannot see all of (#10506)

* fix(pm-tooling): refuse windowed history questions the clone cannot see all of

Three seat-run tools asked `--since` questions over a branch with no shallow
guard. A shallow clone answers those from whatever part of the window is
present, exits 0 and prints no warning, so each returned a confidently wrong
smaller number. Agent containers clone shallow and all three run from a seat;
every workflow that reads history already checks out `fetch-depth: 0`, which is
why the exposure survived.

- git-history.mjs: add `historyHorizon()`, the read-only half of the #9878
  helper — one predicate for all adopters, never fetching, and printing a
  deepen command computed so it can only ADD history.
- check-governed-merges.mjs: a repo whose history stops inside the window is
  UNAUDITED, like an absent checkout. It rendered `clean window` over ~40
  governed merges.
- check-engine-split-ratio.mjs: refuse rather than print an ADR trigger metric
  over a short denominator; annotate the horizon when the window is whole.
- collect-release-notes.sh: withhold the cloud section rather than print it
  short, and exit 2.
- lint.yml: run the three self-tests, including git-history's, which nothing in
  this repo ran until now.

Part of #9902

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt

* fix(pm-tooling): stop the horizon annotation claiming what it has not checked

Two defects found by ablating the guards rather than by reading them.

- check-engine-split-ratio: the horizon line spelled "(predates the window)"
  unconditionally, so removing the refusal above it produced a false statement
  beside a wrong number instead of no statement.
- collect-release-notes --self-test: the wiring pin grepped the script for a
  literal that also occurs in the assertion itself, so it matched its own
  source line and printed a tick with section 4 unwired. The needle is now
  assembled from two adjacent literals, and the ablation reddens it.

Part of #9902

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: os-zhuang

.github/workflows/lint.yml

@@ -386,6 +386,50 @@ jobs:
       - name: Release-rehearsal clone preflight self-test
         run: node scripts/pm/release-rehearsal-clone.mjs --self-test
 
+      # Shallow-history guard self-tests (#9902). Three seat-run tools ask
+      # WINDOWED history questions (`--since` over a branch), and a shallow
+      # clone answers those from whatever part of the window is present, exits
+      # 0, and prints no warning. Agent containers clone shallow, and all three
+      # run from a seat rather than from CI — every workflow that reads history
+      # already checks out with `fetch-depth: 0`, which is precisely why the
+      # exposure survived: CI is not where these run.
+      #
+      # Measured in one container on 2026-08-21 (graft floor 2026-06-02):
+      # `check-governed-merges` rendered `✅ clean window` for a window in which
+      # GitHub lists 38 commits touching `docs/adr/**` and 13 touching
+      # `AGENTS.md`; `check-engine-split-ratio --days 90` — the workflow's own
+      # invocation — printed a 98.1% ADR trigger metric over a denominator 17
+      # commits short, one of whose members was the graft boundary commit
+      # itself (it carries the whole tree, so a truncated window does not just
+      # lose data points, it fabricates one).
+      #
+      # What runs here is the self-tests, not the live tools: the live tools
+      # judge whatever clone they are pointed at, and a CI checkout's depth is
+      # the workflow's business, not a verdict this job can hold. Each pins BOTH
+      # directions on real temp-git fixtures — a window crossing the floor is
+      # refused, and a still-shallow clone whose floor PREDATES the window is
+      # answered untouched, because the predicate is the floor rather than
+      # `--is-shallow-repository` and a guard that refused provably-correct
+      # answers would only train bypass.
+      #
+      # `git-history.mjs` is listed first and deliberately: it is the shared
+      # predicate all three call, it shipped for #9878 with a self-test that
+      # until now NOTHING in this repo ran, and an unrun self-test is a phantom
+      # check — the AGENTS.md rule about `@ts-expect-error` in an uncompiled
+      # file, wearing a different hat. Invoked as `node`/`bash` rather than
+      # through `pnpm check:*`: that alias belongs in root package.json, which
+      # is declared territory of the @changesets/cli v3 migration lane (#9465)
+      # while it runs. Temp-dir fixtures, no network, ~6 s in total.
+      #
+      # (`check-governed-merges.mjs`'s own cases run in the
+      # `pnpm check:pm-governed-merges` step above, which is already its
+      # self-test.)
+      - name: Shallow-history guard self-tests
+        run: |
+          node scripts/pm/git-history.mjs --self-test
+          node scripts/check-engine-split-ratio.mjs --self-test
+          bash scripts/collect-release-notes.sh --self-test
+
       # Verify-lock entry-point self-test (#9661). `scripts/pm/os-verify-lock.sh`
       # is the ONE way an agent takes the container's shared heavy-verify lock,
       # and it is the enforcement of a rule that used to live only in prose: the