fix(agent-repo): full-history clone for reference + upstream-ref fetch

Probe 7 (2026-05-08) finally surfaced the actual push error:

  ! [remote rejected] HEAD -> task-9dc266b5 (shallow update not allowed)

Cause: REFERENCE_BRANCHES handler clones with --depth 1, AR-14a then
fetches upstream-ref --depth 1. The agent's task branch is a single
commit on top of a single shallow commit — no ancestry visible. Gitea
rejects shallow pushes server-side.

Fix:
- Reference clone drops --depth 1 (full history)
- AR-14a fetch upstream-ref drops --depth 1 (full fetch from local-path)
- Cost: a few extra MB per task on tmpfs/PVC. Acceptable.

This unblocks AR-14a's upstream-seeding for the dogfood pipeline. The
agent's branch now has the full upstream history visible to gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harnesses/contexts/agent-repo/v1/init.sh

@@ -22,8 +22,12 @@ for ref in refs:
     branch = ref.get('branch', 'main')
     dest = f'/workspace/reference/{name}'
     print(f'Cloning {repo_url} ({branch}) -> {dest}')
+    # Full clone (no --depth) so AR-14a-seeded agent branches have visible
+    # ancestry when pushed back to the agent-repo. Gitea rejects shallow
+    # pushes with "shallow update not allowed". Real incident: 2026-05-08
+    # probe 7. The cost is a few extra MB on a tmpfs/PVC; acceptable.
     result = subprocess.run(
-        ['git', 'clone', '--depth', '1', '--branch', branch,
+        ['git', 'clone', '--branch', branch,
          '-c', 'core.symlinks=false', repo_url, dest],
         capture_output=True, text=True
     )
@@ -63,7 +67,13 @@ if [ -n "${AGENT_REPO_URL:-}" ] && [ -n "${AGENT_BRANCH:-}" ]; then
                 #
                 # Use a temporary remote name so we don't collide with 'origin'.
                 git remote add upstream-ref "$REF_REPO"
-                git fetch upstream-ref --depth 1 2>&1 | head -3 || {
+                # Full fetch (no --depth) — the agent's branch will be pushed
+                # back to the agent-repo, and gitea rejects shallow pushes
+                # with "shallow update not allowed". Even though the
+                # reference clone itself may be shallow, fetch as much as
+                # the source has so the agent's HEAD has visible ancestry.
+                # Real incident: 2026-05-08 probe 7 (shallow update reject).
+                git fetch upstream-ref 2>&1 | head -3 || {
                     echo "WARNING: failed to fetch from upstream reference; falling back to fork main" >&2
                     git remote remove upstream-ref 2>/dev/null
                     git checkout -b "$AGENT_BRANCH"