Accept a source commit a branch or tag contains

[shiny-code-app]

Every merge to devkit main broke the next artifact build of every site pinned to the previous main tip. The publish check required each source commit to be a ref tip (git ls-remote). After #137 moved main, cm-website's pin 74f4cf7, still an ancestor of main, was refused, and cm-website#108's build failed.

What changed

• The ref-tip check stays. When the commit is not a tip, remote_branch_or_tag_contains_commit does the following:
  • fetches only commit history (--filter=tree:0) for the origin's branches and tags into a temporary bare repository, created with an empty template and with lazy fetching disabled;
  • accepts the commit only if a branch or tag contains it.
• The commit is never fetched by id. GitHub serves any commit in a fork network that way, so a fork-only commit still fails. PR refs are not in the history fetch; PR tips stay accepted by the existing tip rule.
• docs/tooling/artifact-inputs.md says what "published in its origin" now means.

Review

OpenAI gpt-6.1-sol found the reachability rule sound under the fork threat model. Two findings are applied:

• an inherited git template could seed a tag into the verification repository, so it now uses --template=;
• a missing-object probe could lazily fetch the commit by id, so the probe is gone and GIT_NO_LAZY_FETCH=1 is set.

Declined: a Git version check for --filter=tree:0. Every supported Git has had it since 2.20, and a failed fetch already stops with Git's error.

Verification

• A new real-git test accepts an ancestor of main and refuses a commit whose branch was deleted.
• The full suite passes (320 tests), as does ruff.
• Live: 74f4cf7 is accepted against cbusillo/odoo-devkit, and an unknown commit is refused.

Fixes #139