Prevent stale-base signed replay from synthesizing unrelated changes; enforce policy on GraphQL payload

[Copilot]

When safe-outputs runs on a shallow/stale checkout and base advances, signed replay could compute fileChanges from an old parent while targeting current origin/<base>, producing large unrelated reverts and bypassing protected_files checks. This change hardens signed replay so payload synthesis is based on a compatible base and policy is enforced on what is actually sent to GraphQL.

• Signed replay base-alignment (stale-parent guard)

  • Detects mismatch between replay parent and GraphQL parent.
  • If current GraphQL parent is not an ancestor of HEAD, rebases local replay range onto current parent before GraphQL replay.
  • On rebase conflict, aborts and fails with explicit guidance instead of emitting synthesized unrelated changes.

• Payload-level policy enforcement (defense in depth)

  • Validates synthesized fileChanges (the actual GraphQL payload), not only agent-emitted patch text.
  • Enforces:
    • max_patch_files
    • max_patch_size
    • protected_files policy
  • Treats violations as hard refusal paths (no unsigned push fallback).

• Bundle history readiness in shallow clones

  • ensureFullHistoryForBundle now unshallows (git fetch --unshallow origin) before bundle processing so prerequisite ancestry/merge-base logic is reliable.

• Handler integration

  • create_pull_request and push_to_pull_request_branch now pass handler config into pushSignedCommits as validationConfig, enabling payload-level policy checks during signed replay.

await pushSignedCommits({
  githubClient,
  owner,
  repo,
  branch,
  baseRef: `origin/${baseBranch}`,
  cwd,
  signedCommits,
  validationConfig: config, // enforce protected_files/max_patch_* on synthesized GraphQL payload
});

[dsyme]

Unshallow should not be used,

[g-jobayer]

Fixes #35550