fix(standards): scope from HEAD^1 so private repos stop sweeping whole-repo

[twistedmelonman]

Problem

Changed-files scoping has never worked on a private repo. Every PR in one is linted whole-repo and fails on debt its author never touched — precisely what the scoping exists to prevent (standards-check.yml:25-31).

Cause

"Resolve scope" narrowed the run by fetching the PR base:

git -C repo fetch --depth=1 origin "${BASE_SHA}"

The checkout immediately above sets persist-credentials: false, so no credential remains. A public repo serves that fetch unauthenticated and scopes correctly. A private repo cannot:

fatal: could not read Username for 'https://github.com': No such device or address

and the step falls back to a whole-repo sweep — correctly and loudly, but on every PR, forever.

Repo	Private	Result
nightowlstudiollc/kebab-tax	yes	fetch failed → whole-repo
nightowlstudiollc/financial-agent	yes	fetch failed → whole-repo
nightowlstudiollc/amelia-boone	no	scoped ✅
smartwatermelon/archive-resolver	no	scoped ✅
twistedmelonman/dotfiles	no	scoped ✅

9 private repos carry a standards-check caller and are affected.

Fix

Take the base from the local commit graph instead of the network.

For a pull_request event HEAD is refs/pull/N/merge, whose first parent is the base. fetch-depth: 2 makes HEAD^1 the diff target — no fetch, no credential, and persist-credentials: false stays exactly as it is. That setting is deliberate hardening against zizmor's artipacked, not an oversight to route around.

HEAD^1 is also strictly more accurate than the payload's base.sha, which goes stale if the base branch moves after the event fires. HEAD^1 is the base the merge ref was actually computed against; when they differ the run now says so.

The subtle part

On a non-merge HEAD, HEAD^1 still resolves — to the previous commit in linear history. Scoping to that would lint one commit's files instead of the PR's: a false-narrow, and a green check over too few files is worse than a noisy sweep. So the merge shape is now asserted, not assumed via parent count, and anything else falls back to the sweep.

Verification

Three fixture repos, exercising the real logic:

Case	Expected	Result
Merge ref at depth 2	scope to base, exclude pre-existing debt	PASS — scoped, debt.md excluded
Non-merge HEAD	refuse to scope	PASS — sweeps (1 parent)
Root commit	refuse to scope	PASS — sweeps (0 parents)

actionlint, yamllint (canonical config) and zizmor all clean. Local code-reviewer, adversarial-reviewer and codebase reviewer all PASS.

This PR cannot prove itself. github-workflows is public, so its own run scopes either way. The fix is only proven by a private repo logging scoping to files changed since — nightowlstudiollc/kebab-tax#1270 is the intended first check, after the standards-check-v1 tag moves.

Closes #170

https://claude.ai/code/session_017s2qrmkQaV54fbcMzB2KRm