Development record

ultra-v0.6.8 C2: the check job in .github/workflows/ci.yml checks out with the default shallow depth (no fetch-depth: 0, unlike the release-gate, record-lint and secret-scan jobs), so BASE_SHA is never a present object, git cat-file -e always fails, and the record-lint step always takes the unarmed fallback. The -agent-diff arm the comment says enforces agent_contract's unbumped-edit check is structurally unreachable, and the step reports green without saying it downgraded. Fix: fetch-depth: 0 on that checkout and a ::warning:: on the fallback so a silent downgrade is visible.