feat: fetch a force-pushed approval commit instead of dismissing blind

[asyncawaitpromise]

Summary / Background

When a branch is rebased or force-pushed, the commit an approval points at stops
being reachable from any local ref. ChangesSince then fails on
git diff base...<approvalSHA>, and the approval lands in badApprovals with
no ownership check at all.

That dismissal is not "your files changed". It is "I could not tell, so I reset
you".

The fix

GitHub still serves the orphaned object. With fetch_orphaned_approval on, a ref
which cannot be resolved locally is fetched from origin once and the diff
retried, so the approval is judged on its diff rather than lost to a rewritten
branch.

Fail-safe

If the fetch or the retry fails, the original diff error stays the cause and the
approval is dismissed exactly as before. Nothing gets less safe.

Hardening

• The fetch is bounded at 60s. It is the only git call here that waits on a
  remote; every other one is local and returns promptly.
• The ref is passed after a -- so a ref beginning with a dash cannot be read as
  an option. git fetch accepts --upload-pack, which names a command to run.
• The original diff error is preserved as the wrapped cause, with any fetch or
  retry failure appended.

Flag

Opt-in, default off. It is the only setting in codeowners.toml which adds a
network call to a run, so enabling it should always be a deliberate choice rather
than something inherited.

Verification

An end-to-end test builds a repository whose approved commit exists only on the
remote, asserts the commit genuinely does not resolve locally (otherwise both
cases would pass for the wrong reason), and checks that the approval is dismissed
with the flag off and recovered with it on.

[gemini-code-assist]

Code Review

This pull request introduces an 'Approval Retention' feature, allowing configuration to retain existing approvals across specific types of changes (e.g., whitespace, comments, formatting, string literals, renames) and enabling the fetching of orphaned approval commits from the remote repository. The implementation includes updates to the configuration structure, logic to handle git diff options, and comprehensive testing for both the configuration and the new git fetching capabilities. My feedback addresses an issue in the error handling of the fetchRef function, where discarding the command output makes debugging git failures difficult; I have provided a suggestion to include the command output in the returned error.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Compute approval diff] --> B{Diff succeeds?}
    B -- Yes --> C[Evaluate changed-file ownership]
    B -- No --> D{Recovery enabled and commit-shaped ref absent locally?}
    D -- No --> E[Return original diff error]
    D -- Yes --> F[Fetch commit from origin with timeout]
    F --> G{Fetch succeeds?}
    G -- No --> E
    G -- Yes --> H[Retry approval diff]
    H --> I{Retry succeeds?}
    I -- No --> E
    I -- Yes --> C

Loading

[github-actions]

Codeowners approval required for this PR:

• @BakerNet or @zbedforrest

[github-actions]

Codeowners approval required for this PR:

• @BakerNet or @zbedforrest