fix(build): fetch pinned commit (shallow clone lacks it)

git clone --depth 1 --branch X only fetches the branch tip. When the
branch advances between workflow trigger and runner pickup, checking
out the pinned commit failed with "reference is not a tree: <sha>".
Fetch that exact commit (git fetch --depth 1 origin <sha>) before
checkout, on both Linux (SSH) and Windows (WinRM) paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/ci_orchestrator/commands/build.py

@@ -151,8 +151,15 @@ def _linux_build(
             )
             t.run(cmd)
             if clone_commit:
+                # The shallow --depth 1 --branch clone only has the branch
+                # tip. If the branch advanced between workflow trigger and
+                # runner pickup, the pinned commit is absent ("reference is
+                # not a tree"). Fetch exactly that commit, then check out.
                 t.run(
-                    f"git -C {_sh_quote(workdir)} checkout {_sh_quote(clone_commit)}"
+                    f"git -C {_sh_quote(workdir)} fetch --depth 1 origin "
+                    f"{_sh_quote(clone_commit)} && "
+                    f"git -C {_sh_quote(workdir)} checkout "
+                    f"{_sh_quote(clone_commit)}"
                 )
         else:
             raise click.ClickException(
@@ -275,7 +282,12 @@ def _windows_build(
                 f"{_ps_quote(clone_url)} (Split-Path {_ps_quote(workdir)} -Leaf)"
             )
             if clone_commit:
+                # Shallow clone has only the branch tip; fetch the pinned
+                # commit explicitly so checkout works even if the branch
+                # advanced between trigger and runner pickup.
                 t.run(
+                    f"git -C {_ps_quote(workdir)} fetch --depth 1 origin "
+                    f"{_ps_quote(clone_commit)}; "
                     f"git -C {_ps_quote(workdir)} checkout {_ps_quote(clone_commit)}"
                 )
         else: