#21576 fix(ci): avoid partial-clone timeout in guarded merge checks

Summary

The guarded merge helper's merged-head verification could stall or time out when its checkout was a blob:none partial clone. It tried to materialize a full worktree solely to run the Swift god-file and web vp checks.

This change computes the exact merged tree with git merge-tree --write-tree, then archives only the Swift/web paths those checks inspect. Merge-conflict detection and the existing guard checks remain fail-closed, while unrelated historical blobs are no longer fetched.

Validation

• bash -n scripts/gh-merge-green
• git diff --check
• Exact-head merge-tree/archive path exercised against cmux PR #21433

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes guarded merge checks timing out on blob:none partial clones. The helper previously materialized a full worktree to run the Swift god-file and web vp checks; it now computes the merged tree with git merge-tree --write-tree and archives only the paths those checks inspect, so unrelated historical blobs are no longer fetched. The base tree is archived separately for the red-base vp comparison (now with locked dependencies installed), since the merged archive is not a worktree. Merge-conflict detection and existing guard checks remain fail-closed, and merges are refused if the checked tree objects cannot be materialized. Makes refusal diagnostics portable on macOS by switching from paste to python3 for joining lists.

Summary by CodeRabbit

• Bug Fixes
  • Merge checks now evaluate checked files against the combined changes from the target branch and proposed update, while continuing to refuse merges with conflicts.
  • Merges are refused when checked files cannot be prepared for validation, and temporary files are cleaned up after these failures.
  • Base-branch webview checks now use a separately prepared baseline and install locked dependencies before validation.