fctl.sh keeps old docs when CI fails on the push that changed them #105

What is wrong

fctl.sh still shows fctl's docs from before two-factor sign-in and passkeys (#103, #104), which v0.8.0 shipped: hyperstructure/fctl-site's fctl-docs.ref is still 8e4bc48.

How it works now

Pin fctl.sh to these docs in .github/workflows/ci.yml runs on a push to main once cargo xtask check passes, and pins only when docs/ differs from the push's before commit. On 2026-10-19:

1. 65dcbe1 (feat: add two-factor sign-in with authenticator apps #103, feat: sign in with passkeys #104) changed docs/. Its cargo xtask check failed on a flaky test (run), so the job was skipped.
2. The release commit 0840d6c changed no docs. Its run compared docs/ with 65dcbe1, found nothing new and skipped the pin (run).

Nothing pins those docs until the next push that changes docs/. Re-running the failed run's jobs would pin them, but it would also run Deploy app.fctl.sh for 65dcbe1, putting a build that reports 0.7.0 back over 0.8.0.

What should happen

• The job compares docs/ with the commit fctl-site pins now (fctl-docs.ref on its main; the repository is public, so reading it needs no key) rather than with the push's before, so the next green push to main pins docs that a failed run left behind. (ci: pin docs that a failed run left behind, and never older ones #307; its merge's run pinned eb9a037 over 06e5af4)
• It never pins a commit older than the pinned one (git merge-base --is-ancestor), for runs that finish out of order. (ci: pin docs that a failed run left behind, and never older ones #307, checked against local stand-ins as its description says)
• fctl.sh shows the v0.8.0 docs again: docs: pin hyperstructure/fctl@0840d6cfec52 fctl-site#25 pins 0840d6c.

Compatibility

CI only: no release, migration or protocol change.

Session: https://app.fctl.sh/s/ses_01M5AFQJTX6FENQJJZWRD5AP5K