fix: verify CI checkout trust and real Git test selection

[LucaLin233]

Summary

• Verify checkout recognition in both required jobs before tests; scope safe.directory to the exact CI workspace, never a wildcard.
• Disable persisted checkout credentials before running repository tests.
• Add real local Git integration fixtures for empty/full PR ranges, diverged merge bases, rename fallback, invalid history and non-repository fallback. Keep existing mocked mapping coverage.

Scope

Independent infrastructure fix. PR #41 and all business scripts remain unchanged.

Validation

Host: changed shell bash -n and git diff --check passed. No local test suites or ShellCheck run; both required CI jobs perform verification, including the new integration test before the full suites.
Historical Debian logs show checkout succeeds with temporary HOME trust, followed by git diff failing to recognize the repository. Workspace-scoped trust is tested in CI; historical root cause is not yet conclusively proven.

Risks

Infrastructure changes correctly trigger full-suite fallback. Existing unrelated push failures may still block CI; no tests bypassed, job names/timeouts/distributions unchanged.

Rollback

Revert this PR commit. No production configuration changed.

Do not merge; await independent review and explicit authorization.