test: tighten historical-pin checks per review of 941eb28b

- test_refined_dfg::test_source_pin runs its mismatch negative controls
  first (now including window mode) so missing history cannot skip them.
- test_re100: renamed to test_manifest_matches_its_pinned_commit, plus an
  explicit record that today's src differs from the pin.
- Structural manifest checks run before any history-dependent check.
- Real tamper test: a flipped digest raises via verify_manifest, and a
  path absent at the commit raises ValueError.
- A blobless clone (tree present, blob missing) is reported as unavailable
  history, not as a missing path.
- All history skips go through history_unavailable(): fatal when
  CELERIS_REQUIRE_HISTORY=1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/validation/run_jet_circle_cv.py

@@ -223,12 +223,11 @@ def verify(repo):
 
 def verify_historical(repo):
     """The pinned manifest describes the PIN tree (read with git, not the working tree)."""
-    from source_provenance import historical_sha256
+    from source_provenance import verify_manifest
     manifest = json.loads((HERE / "data/jet_circle_cv/source_manifest.json").read_text())
     if manifest["revision"] != PIN:
         raise RuntimeError("Wrong pinned revision")
-    if historical_sha256(repo, PIN, manifest["files"]) != manifest["files"]:
-        raise RuntimeError("Historical manifest does not match its pinned revision")
+    verify_manifest(repo, PIN, manifest["files"])
     return manifest
 
 

tests/validation/source_provenance.py

@@ -34,15 +34,28 @@ def historical_sha256(repo, commit, paths):
         raise HistoryUnavailable(f"commit {commit} is not available in {repo}") from error
     digests = {}
     for path in paths:
-        try:
-            blob = subprocess.run([*git, "show", f"{commit}:{path}"], check=True,
-                                  capture_output=True).stdout
-        except subprocess.CalledProcessError as error:
-            raise ValueError(f"{path} is not part of {commit}") from error
-        digests[path] = hashlib.sha256(blob).hexdigest()
+        listed = subprocess.run([*git, "ls-tree", "--name-only", commit, "--", path],
+                                capture_output=True, text=True)
+        if listed.returncode:
+            raise HistoryUnavailable(f"tree of {commit} is not available in {repo}")
+        if listed.stdout.strip() != path:
+            raise ValueError(f"{path} is not part of {commit}")
+        shown = subprocess.run([*git, "show", f"{commit}:{path}"], capture_output=True)
+        if shown.returncode:  # e.g. a blobless partial clone without network access
+            raise HistoryUnavailable(f"content of {path} at {commit} is not available in {repo}")
+        digests[path] = hashlib.sha256(shown.stdout).hexdigest()
     return digests
 
 
+def verify_manifest(repo, commit, digests):
+    """Raise RuntimeError naming the first path whose recorded digest differs at `commit`."""
+    actual = historical_sha256(repo, commit, digests)
+    for path, digest in digests.items():
+        if actual[path] != digest:
+            raise RuntimeError(f"Historical manifest mismatch at {commit}: {path}")
+    return actual
+
+
 def historical_tree(repo, commit, prefix="src"):
     """Tracked file names under `prefix` at `commit` (HistoryUnavailable if missing)."""
     historical_sha256(repo, commit, [])