Full git clone for single-commit verification is wasteful

[lcarva]

Description

In verify.py:30-32, every verification clones the entire repository history. For large repos (e.g., CPython, numpy), this downloads hundreds of megabytes unnecessarily.

subprocess.run(
    ["git", "clone", repo_url, str(dest)],
    check=True,
    capture_output=True,
)

Impact

Slow verification for large repositories and potential resource exhaustion.

Suggested fix

• For tag-based refs: use --depth=1 --branch <tag>
• For commit SHAs: use git init + git fetch <url> <sha> --depth=1 + git checkout FETCH_HEAD (supported by most major hosts)
• Fall back to full clone only when shallow strategies fail