feat: fetch a force-pushed approval commit instead of dismissing blind

[asyncawaitpromise]

Summary / Background

When a branch is rebased or force-pushed, the commit an approval points at stops
being reachable from any local ref. ChangesSince then fails on
git diff base...<approvalSHA>, and the approval lands in badApprovals with
no ownership check at all.

That dismissal is not "your files changed". It is "I could not tell, so I reset
you".

The fix

GitHub still serves the orphaned object. With fetch_orphaned_approval on, a ref
which cannot be resolved locally is fetched from origin once and the diff
retried, so the approval is judged on its diff rather than lost to a rewritten
branch.

Fail-safe

If the fetch or the retry fails, the original diff error stays the cause and the
approval is dismissed exactly as before. Nothing gets less safe.

Hardening

• The fetch is bounded at 60s. It is the only git call here that waits on a
  remote; every other one is local and returns promptly.
• The ref is passed after a -- so a ref beginning with a dash cannot be read as
  an option. git fetch accepts --upload-pack, which names a command to run.
• The original diff error is preserved as the wrapped cause, with any fetch or
  retry failure appended.

Flag

Opt-in, default off. It is the only setting in codeowners.toml which adds a
network call to a run, so enabling it should always be a deliberate choice rather
than something inherited.

Verification

An end-to-end test builds a repository whose approved commit exists only on the
remote, asserts the commit genuinely does not resolve locally (otherwise both
cases would pass for the wrong reason), and checks that the approval is dismissed
with the flag off and recovered with it on.

[gemini-code-assist]

Code Review

This pull request introduces an 'Approval Retention' feature, allowing configuration to retain existing approvals across specific types of changes (e.g., whitespace, comments, formatting, string literals, renames) and enabling the fetching of orphaned approval commits from the remote repository. The implementation includes updates to the configuration structure, logic to handle git diff options, and comprehensive testing for both the configuration and the new git fetching capabilities. My feedback addresses an issue in the error handling of the fetchRef function, where discarding the command output makes debugging git failures difficult; I have provided a suggestion to include the command output in the returned error.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/git/diff.go	Adds guarded, timeout-bounded orphaned-commit fetching and historical-diff retry behavior while preserving original errors.
internal/app/app.go	Enables orphaned-approval recovery only when the repository configuration explicitly requests it.
internal/config/config.go	Adds the opt-in fetch_orphaned_approval TOML setting with the zero-value default remaining disabled.
internal/git/diff_test.go	Covers successful recovery, disabled behavior, unrelated diff failures, fetch and retry errors, argument ordering, and timeout use.
internal/app/orphaned_approval_test.go	Exercises approval dismissal and recovery against a real repository where the approval commit exists only on the remote.
README.md	Documents the new opt-in network behavior, default, purpose, and timeout.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Compute changes since approval] --> B{Historical diff succeeds?}
  B -->|Yes| C[Evaluate later owned changes]
  B -->|No| D{Recovery enabled?}
  D -->|No| E[Dismiss approval as unsafe]
  D -->|Yes| F{Approval commit resolves locally?}
  F -->|Yes| E
  F -->|No| G[Fetch commit from origin with timeout]
  G -->|Failure| E
  G -->|Success| H[Retry historical diff]
  H -->|Failure| E
  H -->|Success| C

Loading

_{Reviews (2): Last reviewed commit: "feat: recover an approval whose commit n..." | Re-trigger Greptile}

[github-actions]

Codeowners approval required for this PR:

• @BakerNet or @zbedforrest