feat: publish Gamertan Tend preview source

Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist.

AI-assisted: OpenAI Codex helped implement, test, and audit this preview.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/provenance/git.go

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package provenance
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"gamertan.com/tend/internal/process"
+)
+
+type Source struct {
+	Commit string
+	Epoch  int64
+}
+
+func Inspect(ctx context.Context, runner process.Runner, dir, branch string) (Source, error) {
+	status, err := runner.Run(ctx, dir, nil, "git", "status", "--porcelain=v1", "--untracked-files=all")
+	if err != nil {
+		return Source{}, err
+	}
+	if len(status) != 0 {
+		return Source{}, errors.New("source checkout is not clean")
+	}
+	commitOut, err := runner.Run(ctx, dir, nil, "git", "rev-parse", "HEAD")
+	if err != nil {
+		return Source{}, err
+	}
+	commit := strings.TrimSpace(string(commitOut))
+	if len(commit) != 40 {
+		return Source{}, errors.New("source commit is not a full SHA-1 object id")
+	}
+	remoteOut, err := runner.Run(ctx, dir, nil, "git", "ls-remote", "--exit-code", "origin", "refs/heads/"+branch)
+	if err != nil {
+		return Source{}, fmt.Errorf("verify pushed commit: %w", err)
+	}
+	fields := strings.Fields(string(remoteOut))
+	if len(fields) != 2 || fields[0] != commit || fields[1] != "refs/heads/"+branch {
+		return Source{}, errors.New("HEAD is not the exact pushed branch commit")
+	}
+	epochOut, err := runner.Run(ctx, dir, nil, "git", "show", "-s", "--format=%ct", commit)
+	if err != nil {
+		return Source{}, err
+	}
+	epoch, err := strconv.ParseInt(strings.TrimSpace(string(epochOut)), 10, 64)
+	if err != nil || epoch <= 0 {
+		return Source{}, errors.New("commit timestamp is invalid")
+	}
+	return Source{Commit: commit, Epoch: epoch}, nil
+}