Why: test-pg only cloned the default branch, so prev_sha and legacy_sha were never built or attested.
Evidence: SELF python3 -m unittest tests.test_ci_credentials tests.test_lifecycle_pin (11 tests, exit 0).
Impact: the lifecycle suite prints the combination inventory and keeps login and rdm.ping as NOT_RUN.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>