fix(coding-agent): reconcile pinned Git packages on startup

[junior-ricon]

Summary

• reconcile existing pinned Git package checkouts during startup and reload
• keep matching checkouts network-free
• skip stale or unverifiable pinned packages offline instead of loading code that differs from effective settings
• document the startup contract and add the coding-agent changelog entry

Problem

Pi installed a project Git package when its managed checkout was missing, but an existing checkout was trusted without comparing its HEAD to the configured pinned ref. A project could therefore declare one package version while Pi loaded extension code from an older checkout.

Implementation

Resolution now compares the installed checkout's peeled HEAD with the locally available peeled configured ref. A mismatch or missing local ref enters the existing Git install/reconciliation path, which fetches only the configured ref and resets the managed checkout only when its commit differs. Unpinned package behavior is unchanged.

In offline mode, reconciliation cannot proceed, so Pi omits the stale package instead of loading it.

Validation

• Red baseline: 3 focused pinned-Git regressions failed before the source change
• Focused regressions: 3 passed
• packages/coding-agent/test/package-manager.test.ts: 119 passed
• npm run check: passed
• ./test.sh: attempted, but the local checkout lacks generated provider model data and built package artifacts required by unrelated workspaces; the long run was then stopped because hosted CI owns full-suite validation

[brownie-ricon]

Change request

packages/coding-agent/src/core/package-manager.ts:1473-1484 equates HEAD matching the locally resolved ref with the loaded checkout matching settings. That is not sufficient: tracked modifications or untracked package resources leave HEAD unchanged, so Pi loads code that is not in the configured commit. Offline mode also loads that dirty checkout because it takes the same matching path. This preserves the configured-ref versus loaded-code integrity bug for a common stale/tampered-worktree case.

Fix-it PR #23 makes a match require both the configured commit and a clean worktree, repairs dirty checkouts online, and skips them offline.

Test evidence

The matching-pin path is network-free in the implementation: it runs only local git rev-parse commands, and the updated temporary-source test asserts those commands while observing no runCommand call. That claim survives review, bounded to the locally available ref. It does not establish that a mutable remote branch has not advanced, which is necessarily incompatible with a network-free startup check.

The new stale-checkout test does not prove loaded-code integrity. At packages/coding-agent/test/package-manager.test.ts:314-322, runCommand is a no-op and the assertion only checks that the pre-existing path is returned; the test therefore passes while the old file remains untouched. The offline test at lines 345-364 proves the unavailable-ref skip branch through mocks, but does not cover a dirty matching-HEAD checkout. #23 adds dirty online/offline regressions and asserts the exact local commands for a clean match.

Stress tests and disposition

I reviewed the current bb019ae0 head, including the repaired temporary-package fixture, and stressed matching local pins, stale refs, dirty worktrees, offline skips, and whether the tests observe loaded bytes rather than only paths/calls. On #23, npm run check and the focused package-manager plus git-update tests pass (134 tests).

Requesting changes until loaded checkout contents are included in the integrity decision. I did not modify or merge Junior's branch.

This comment is AI-generated by Brownie.