feat(ci): ratchet raw repo connectionId host checks; migrate the cheap ones (#31096)

* feat(ci): ratchet raw repo connectionId host reads; one drop-in resolver

Codex review 6 class fix (#4/#6/#7): host decisions read off a repo row's
legacy connectionId miss rows that name SSH only as executionHostId.

- getRepoRoutingConnectionId (shared/execution-host.ts): drop-in for a raw
  repo.connectionId routing check that also finds executionHostId-only SSH.
- check-repo-host-read-ratchet: per-file count of raw repo connectionId
  reads in src/main, src/shared, src/cli; counts may only shrink.
- Migrated 66 cheap reads: runtime GitHub/GitLab commands, PR/MR head ref
  fetches, preserved-branch cleanup, ref queries, base-ref IPC, worktree
  preparation, trash sweep, scan cache TTL, usage metadata.

* fix(ipc): PR base IPC routes executionHostId-only SSH rows; ratchet is a stated lower bound

Review follow-up (Opus on #31096):
- worktrees:resolvePrBase decided git/gh routing on the raw connectionId while
  its head-ref fetches already used the resolver; one resolved connectionId
  now drives all of it (test fails on main).
- getRepoRoutingConnectionId's contract is stated exactly: never local when the
  raw field is set; on a contradictory ssh row executionHostId wins.
- The ratchet regex no longer matches report.connectionId; header and docs
  say it is a lower bound.
- Regression tests for a runtime GitHub and GitLab command site.

* test(ci): pin the repo host-read ratchet step to the static phase

* fix(ci): repo host-read ratchet skips verbatim field copies into projected rows

A copy of connectionId into a projected row decides nothing; migrating it to
the resolver would change what the projection publishes. The sidebar feed
catalog's copy (added after the baseline) and two older projections no longer
count; baseline pruned to 91.

src/main/github/pr-head-tracking-ref.test.ts

@@ -40,6 +40,13 @@ describe('fetchPrHeadTrackingRef', () => {
     expect(gitExecFileAsyncMock).not.toHaveBeenCalled()
   })
 
+  it('throws for an SSH repo named only by executionHostId', async () => {
+    await expect(
+      fetchPrHeadTrackingRef({ path: '/repo', executionHostId: 'ssh:gpu' }, 'origin', 'feature/x')
+    ).rejects.toThrow('SSH Git provider is not available')
+    expect(gitExecFileAsyncMock).not.toHaveBeenCalled()
+  })
+
   it('fetches a GitHub pull head into its remote-scoped Orca ref for local repos', async () => {
     const localRef = await fetchGitHubPullRequestHeadRef(
       { path: '/repo', connectionId: null },

src/main/github/pr-head-tracking-ref.ts

@@ -10,6 +10,8 @@ import {
   SSH_GIT_RECONNECT_MESSAGE,
   SshHostNotServedError
 } from '../providers/ssh-host-not-served-error'
+import { getRepoRoutingConnectionId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
 
 type LocalGitExecOptions = {
   cwd: string
@@ -17,13 +19,14 @@ type LocalGitExecOptions = {
 }
 
 export async function fetchPrHeadTrackingRef(
-  repo: { path: string; connectionId?: string | null },
+  repo: { path: string } & Pick<Repo, 'connectionId' | 'executionHostId'>,
   remote: string,
   branch: string,
   options: { localGitExecOptions?: LocalGitExecOptions } = {}
 ): Promise<void> {
-  if (repo.connectionId) {
-    throw new SshHostNotServedError(repo.connectionId, SSH_GIT_RECONNECT_MESSAGE)
+  const sshTargetId = getRepoRoutingConnectionId(repo)
+  if (sshTargetId) {
+    throw new SshHostNotServedError(sshTargetId, SSH_GIT_RECONNECT_MESSAGE)
   }
   await gitExecFileAsync(
     ['fetch', remote, `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`],
@@ -32,7 +35,7 @@ export async function fetchPrHeadTrackingRef(
 }
 
 export async function fetchGitHubPullRequestHeadRef(
-  repo: { path: string; connectionId?: string | null },
+  repo: { path: string } & Pick<Repo, 'connectionId' | 'executionHostId'>,
   remote: string,
   prNumber: number,
   options: { localGitExecOptions?: LocalGitExecOptions } = {}
@@ -43,8 +46,9 @@ export async function fetchGitHubPullRequestHeadRef(
   if (!isSafeReviewHeadFetchRemote(remote)) {
     throw new Error('Pull request fetch remote must not start with "-".')
   }
-  if (repo.connectionId) {
-    throw new SshHostNotServedError(repo.connectionId, SSH_GIT_RECONNECT_MESSAGE)
+  const sshTargetId = getRepoRoutingConnectionId(repo)
+  if (sshTargetId) {
+    throw new SshHostNotServedError(sshTargetId, SSH_GIT_RECONNECT_MESSAGE)
   }
   const localGitExecOptions = options.localGitExecOptions ?? { cwd: repo.path }
   const remoteComponent = await getReviewHeadRemoteComponent(remote, localGitExecOptions)