fix(security): isolate bundle checkouts and verify Git history

[rldyourmnd]

Summary

Private security calls reuse a fixed implementation checkout; files left by an earlier invocation can prevent the exact workflow revision from checking out. Allocate a fresh directory per call and preserve the existing files. Materialize and verify the selected history before Gitleaks so missing partial-clone objects cannot yield an incomplete successful scan.

Type of change

• Fix to an existing workflow
• Hardening / security posture improvement

Threat-model note

Implementation identity remains bound to the called workflow SHA. History hydration uses the existing read-only job token in process environment only, scoped to GitHub HTTPS; it is not written to the caller repository or passed on command arguments. Missing history fails before scanning. Selected ref-history/all-refs scope, scanner behavior, redacted evidence and runner routing are preserved.

Permissions diff

No permission changes: free bundle retains contents: read; paid bundle retains actions: read, contents: read and security-events: write; top-level permissions remain empty.

Validation

Actual YAML-step fixtures execute both variants twice with stale files, require distinct exact checkouts, preserve the stale sentinel and reject the old shared-directory control. Real partial-clone fixtures hydrate missing blobs and reject an unavailable promisor origin without persisting authorization. These focused checks, actionlint and pinned online zizmor 1.26.1 pass on macOS. All core validators pass against the exact published commit 9eb11c2 on the Ubuntu workstation. Touched-path validation is running separately; full scheduled link/calendar checks are advisory. macOS full validation encounters pre-existing fixture dependence on system tools.

Checklist

• Full immutable action pins and least-privilege job permissions preserved.
• Read-only checkout keeps persist-credentials: false.
• Context values remain passed through env.
• Catalog risks, caller examples and changelog updated; docs regenerated.
• Signed and signed-off Conventional Commit.

Tier impact

• Private free tier
• Private paid tier