fix: Use git protocol instead of Gitiles JSON API for retrace spec check

The Gitiles HTTP/JSON API frequently returns CAPTCHA/rate-limit pages
on shared CI runner IPs, causing the check to fail with jq parse errors.
Switch to shallow git fetch + blob hash comparison which uses the git
protocol and avoids the CAPTCHA gate entirely.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: romtsn

scripts/check-retrace-spec.sh

@@ -1,24 +1,29 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-TRACKED_COMMIT="e212426be84283876b6bb832630c0de25a2a7bc5"
+# Blob hash of doc/retrace.md at the last known state.
+# To update: run this script's fetch logic manually and replace the hash.
+TRACKED_BLOB="ae22ff183a460d25fc0cecdd2d34f5b32ae216d9"
 
-# tail -n +2 to remove the magic anti-XSSI prefix from the Gitiles JSON response
-LATEST_COMMIT=$(curl -sf \
-  'https://r8.googlesource.com/r8/+log/refs/heads/main/doc/retrace.md?format=JSON' \
-  | tail -n +2 \
-  | jq -r '.log[0].commit')
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
 
-if [ -z "$LATEST_COMMIT" ] || [ "$LATEST_COMMIT" = "null" ]; then
-  echo "ERROR: Failed to fetch latest commit from Gitiles" >&2
+git init -q "$TMPDIR"
+git -C "$TMPDIR" remote add origin https://r8.googlesource.com/r8
+git -C "$TMPDIR" fetch --depth=1 origin refs/heads/main 2>/dev/null
+
+LATEST_BLOB=$(git -C "$TMPDIR" ls-tree FETCH_HEAD -- doc/retrace.md | awk '{print $3}')
+
+if [ -z "$LATEST_BLOB" ]; then
+  echo "ERROR: Failed to read doc/retrace.md blob from r8 repo" >&2
   exit 1
 fi
 
-echo "Tracked commit: $TRACKED_COMMIT"
-echo "Latest commit:  $LATEST_COMMIT"
+echo "Tracked blob: $TRACKED_BLOB"
+echo "Latest blob:  $LATEST_BLOB"
 
-if [ "$LATEST_COMMIT" != "$TRACKED_COMMIT" ]; then
-  echo "Spec has been updated! Latest: https://r8.googlesource.com/r8/+/${LATEST_COMMIT}/doc/retrace.md"
+if [ "$LATEST_BLOB" != "$TRACKED_BLOB" ]; then
+  echo "Spec has been updated! View at: https://r8.googlesource.com/r8/+/refs/heads/main/doc/retrace.md"
   exit 1
 fi