fix: never read a failed git call as no repository, and never lose a staged transcript silently

[REPPL]

A burst of twelve simultaneous sub-agent completions on a loaded CI runner staged only ten or eleven transcripts, while every hook exited 0. The record had been deferred twice because its cause was not known. This change establishes the cause and fixes it at the primitive.

Cause. It was not the staging lock: each agent has had its own lock since an earlier fix. A git call that fails once (a refused fork, an early-killed git) was read as "no root commit" by gitutil.RootCommit. The sub-agent hook then took a real repository for none. A burst's first completions run before any sibling has noted the session, so the hook staged nothing and exited 0, saying so only on a stderr no one reads. A git shim failing the root lookup for six of twelve hooks loses exactly six on main.

The fix, in three layers:

1. The root-commit lookup. RootCommit now returns (string, error). An empty answer means only a missing directory, no repository (git says so, or no .git entry at or above the path, as written or resolved), or a repository with no commits. Any other failure is an error. All twenty callers handle it: they propagate it, or keep a safe fallback and name the failure, and never take the "no repository" path that keys, creates, migrates or refuses. A related cache is fixed too: a git version probe that could not run was being kept as "git too old" for the rest of the process.
2. The hooks retry. The sub-agent and session-end hooks retry a transient failure, and a stage refused by a held lock, within their hosts' budgets. Session end has 1.5 seconds, so its retries are bounded by time from the hook's start.
3. A loss is visible. A transcript read and still not staged is counted in a marker that abcd history staged reports; under --json it goes to stderr.

New tests cover each layer, and each one was watched failing on the code before it. These include a twelve-way burst with failing root lookups, a staging lock held past its timeout, a session-end retry, a symlinked path, a bare repository, and a version probe that fails once. The hook and marker tests passed three times under -race. An Opus and Sonnet review pair reviewed the change twice, and every finding is folded in.

The guard's own probes not honouring a caller's deadline are captured separately, as a smaller follow-up.

Resolves: iss-2610051434156079
Refs: iss-2610181802344551

Assisted-by: Claude:claude-opus-5-5