fix: Use git protocol for retrace spec check

[romtsn]

Summary

• The Gitiles JSON API returns CAPTCHA/rate-limit pages on shared GitHub Actions runner IPs, causing the retrace spec check to fail with jq: parse error
• Switch from Gitiles HTTP API to shallow git fetch + blob hash comparison, which uses the git protocol and isn't subject to Google's CAPTCHA gate
• Track the file's blob hash instead of the last commit hash — same detection, no HTTP API dependency

Test plan

• Verified script runs successfully locally
• Verify the scheduled CI job passes

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: TMPDIR variable shadows standard environment variable
  • Replaced TMPDIR with non-reserved WORK_DIR and updated all references to avoid environment variable shadowing.

Or push these changes by commenting:

@cursor push 4707bfc43f

Preview (4707bfc43f)

diff --git a/scripts/check-retrace-spec.sh b/scripts/check-retrace-spec.sh
--- a/scripts/check-retrace-spec.sh
+++ b/scripts/check-retrace-spec.sh
@@ -5,14 +5,14 @@
 # To update: run this script's fetch logic manually and replace the hash.
 TRACKED_BLOB="ae22ff183a460d25fc0cecdd2d34f5b32ae216d9"
 
-TMPDIR=$(mktemp -d)
-trap 'rm -rf "$TMPDIR"' EXIT
+WORK_DIR=$(mktemp -d)
+trap 'rm -rf "$WORK_DIR"' EXIT
 
-git init -q "$TMPDIR"
-git -C "$TMPDIR" remote add origin https://r8.googlesource.com/r8
-git -C "$TMPDIR" fetch --depth=1 origin refs/heads/main 2>/dev/null
+git init -q "$WORK_DIR"
+git -C "$WORK_DIR" remote add origin https://r8.googlesource.com/r8
+git -C "$WORK_DIR" fetch --depth=1 origin refs/heads/main 2>/dev/null
 
-LATEST_BLOB=$(git -C "$TMPDIR" ls-tree FETCH_HEAD -- doc/retrace.md | awk '{print $3}')
+LATEST_BLOB=$(git -C "$WORK_DIR" ls-tree FETCH_HEAD -- doc/retrace.md | awk '{print $3}')
 
 if [ -z "$LATEST_BLOB" ]; then
   echo "ERROR: Failed to read doc/retrace.md blob from r8 repo" >&2

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 593ca15. Configure here.}