- read the SHA from the Pinned line (7-40 chars) instead of requiring a
full 40-char SHA the script itself never printed; the old grep died
silently under pipefail
- print the full head SHA to pin
- require the pin to be an ancestor of origin/main, since a rewritten-away
pin still resolves locally until gc
- --diffs now prints patches, not just stats
- --all no longer reports dropped noise
- accept submodule/worktree checkouts where .git is a file
nvrl