fix(ci): track upstream commits outside the PR inventory - #332

What Changed

The upstream tracker now scans first-parent history from a saved SHA and retains commits missing from the PR inventory for manual review. It flags empty PR merge diffs and supports exact Upstream-Commit provenance through intake validation, promotion, and reconciliation.

The scan position advances only with a successful issue update. History rewrites, insufficient PR inventory coverage, and an oversized retained backlog stop the run without advancing it. Existing PR rows and terminal decisions remain compatible.

Why

PR-only tracking misses changes that land outside a recorded PR merge. A read-only scan of 1,121 upstream commits found 21 without PR coverage. It also found that pingdotgg/t3code#7892 records an empty merge commit while its implementation landed separately, so selecting its merge SHA would omit the code.

Validation

• All 55 focused tests passed across commit scanning, provenance, tracking, intake, and the fork feature ledger.
• Scripts typecheck, targeted lint and formatting, and workflow validation passed.
• A read-only live simulation retained all 21 commit entries on a subsequent update and preserved existing terminal decisions.
• Independent review identified a narrow PR-window recovery issue; the fix is covered by a regression test.

Checklist

• This PR is focused on upstream commit coverage
• I explained what changed and why
• No UI changes; screenshots and video are not applicable

Written by an agent (Codex, GPT-6).