test(verify): the base-reachability pin skips where it cannot be judged (CI shallow checkout)

Run 35380095596 failed the 3.12 and 3.13 matrix on PR #24 while every
other job passed and main was green an hour earlier. The cause is the
new test_protected_file_bases_are_reachable_from_main from 34eb537: it
runs `git merge-base --is-ancestor <base> main`, and CI's actions/checkout
is a depth-1 clone of the PR ref with no `main` at all — there the base is
not even an object ("fatal: Not a valid object name d7f568b").
Reproduced locally in a `--depth 1` clone of the branch: same failure.

The property the test pins — both protected-files bases reachable on
origin — cannot be judged in that checkout, so the test now skips with the
reason when the repository is shallow (`rev-parse --is-shallow-repository`)
or has no `main` ref, and judges it everywhere else. Proved three ways:
passes in the full clone; still fails there with the old 3a4f6b01 restored
("not an ancestor of main"); skips in the shallow clone with
"shallow checkout: the bases' reachability cannot be judged here". Module
27/27; ruff/pyright clean.

Author: NetDevAutomate

packages/studyloop/tests/test_verify_plan_integration_script.py

@@ -170,16 +170,25 @@ def test_protected_file_bases_are_reachable_from_main(self, script) -> None:
         check fail on every fresh checkout (2026-09-18: ``3a4f6b01`` survived the
         history consolidation as a dangling object here and nowhere else). Both
         bases must be ancestors of the local ``main`` -- the property a rewritten
-        SHA loses."""
+        SHA loses.
+
+        Judged only where it can be: CI's ``actions/checkout`` is a depth-1
+        clone of the PR ref with no ``main``, where neither base is even an
+        object (run 35380095596 failed the 3.12 and 3.13 matrix on exactly
+        this). There the test skips and says why, rather than reporting a
+        failure the checkout cannot distinguish from the real one."""
         import subprocess
 
+        def git(*args: str) -> subprocess.CompletedProcess[str]:
+            return subprocess.run(["git", *args], cwd=REPO_ROOT, capture_output=True, text=True)
+
+        if git("rev-parse", "--is-shallow-repository").stdout.strip() == "true":
+            pytest.skip("shallow checkout: the bases' reachability cannot be judged here")
+        if git("rev-parse", "--verify", "-q", "main^{commit}").returncode != 0:
+            pytest.skip("no local `main` ref: the bases' reachability cannot be judged here")
+
         for base in (script.PROTECTED_EARLY_BASE, script.PROTECTED_LATE_BASE):
-            result = subprocess.run(
-                ["git", "merge-base", "--is-ancestor", base, "main"],
-                cwd=REPO_ROOT,
-                capture_output=True,
-                text=True,
-            )
+            result = git("merge-base", "--is-ancestor", base, "main")
             assert result.returncode == 0, f"{base} is not an ancestor of main: {result.stderr}"
 
     def test_architect_grants_check_derives_the_ten_names_from_the_inventory(self, script) -> None: