fix(gitstate): fetch fresh and retry so a rejected push can't silently lose a baseline

[pedromvgomes]

Problem

Despite #18 (record the baseline when running on main), wardnet PRs still hit coverage cache misses — see wardnet/wardnet#888. The main-push run for merge-base 9f10325f did measure and commit a baseline, but the push was rejected and silently discarded:

! [rejected]  bulwark-state-staging-... -> bulwark-state (fetch first)
error: failed to push some refs to 'https://github.com/wardnet/wardnet'
recorded coverage baseline for 9f10325f...: rust: 85.8%, typescript: 93.9%   ← printed anyway

WriteBaseline staged its commit on the local origin/bulwark-state tracking ref, last updated by the job's checkout ~8 minutes earlier. wardnet's CI is busy enough that a concurrent run advances the remote branch inside that window, so the push is non-fast-forward — and the rejection was swallowed (return nil), a "best-effort" policy written for the PR-side cache-miss path but fatal to the record-on-main path, where the push is the point. inforge never hits this because its bulwark-state sees far less concurrent traffic.

Fix

• Each attempt fetches the fresh remote ref immediately before creating the staging worktree.
• A rejected push is retried (up to 3 attempts) from the re-fetched ref.
• If the fetched branch already carries the exact content (a concurrent run recorded the same SHA), that's success — no empty commit, no error. Differing content (e.g. healing a poisoned {} entry) still overwrites.
• A push that never lands is returned as an error; cmd/bulwark/coverage.go already downgrades it to a failed to record warning, so the misleading "recorded" line disappears without failing the build.

The new stale-ref test also surfaced a latent data race under -race: executil wired the child's stdout and stderr into the same capture buffer from two os/exec copy goroutines. The shared buffer is now mutex-guarded, with its own regression test.

Testing

TDD: both gitstate tests reproduced the exact failures RED first (stale-ref push silently lost; rejected push returning nil), confirmed RED again with the fix reverted, then GREEN. go build ./..., go test -race ./..., and golangci-lint run ./... all clean.

Merge Commit Message

fix(gitstate): fetch fresh and retry so a rejected baseline push can't be silently lost; sync executil's shared capture buffer

https://claude.ai/code/session_01WE4fbpPvaMDfXeQW2zoBzh