Follow-up to a2b494ddc. The previous fix correctly stopped using
task.baseCommitSha for the contamination check, but the new
resolveContaminationBaseRef tried origin/main first and fell back to
local main only if the origin/main lookup failed. On dev machines that
have not pushed recently, origin/main is a tracking ref that can lag
local main by hundreds of commits. `git merge-base HEAD origin/main`
then resolves successfully and returns the last common ancestor between
the (force-reset-to-local-main) branch and the stale origin/main ref,
which is exactly the same stale SHA the prior bug surfaced. Every
commit on local main since that point is then flagged as foreign
contamination.
Observed: after restarting the engine with a2b494ddc, FN-4315/FN-4403
still failed with `since base e787036b80cc...`. Local main was 166
commits ahead of origin/main; e787036 was the last shared commit.
Fix: reorder the shell fallback to prefer `main` over `origin/main`.
Local main is the canonical integration target for Fusion's merger,
and origin/main is only useful as a fallback when local main does not
exist (rare in a worktree).
Test updated: `resolveContaminationBaseRef returns the current
merge-base...` now asserts local `main` appears before `origin/main` in
the issued command so the shell `||` resolves to local main first.
Fusion-Task-Id: FN-4417
b78b6ae70e