fix: use git rev-parse --verify for shallow clone compatibility

Without --verify, git rev-parse HEAD~1 returns the literal string
"HEAD~1" in shallow clones instead of failing, bypassing the
shallow clone detection. --verify ensures proper failure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ieduer

release_manifest.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
-  "generated_at": "2026-03-16T06:24:31.517877+00:00",
-  "git_head": "ce2c1cdd4e12c3ee1484bcf3b34c9813cc71f747",
+  "generated_at": "2026-03-16T06:27:21.937313+00:00",
+  "git_head": "f57e24de437a046f1444768f6b6d4e1162c32a70",
   "frontend_version": "2026.03.15-r31",
   "source_of_truth": {
     "local_workspace": "authoritative",
@@ -151,8 +151,8 @@
     {
       "kind": "source",
       "logical_path": "scripts/deploy_vps.sh",
-      "size": 16716,
-      "sha256": "321a708e1a4afbcc46ac040057d975e26075e866c5b8e402a61998e09900b5f4"
+      "size": 16725,
+      "sha256": "0eeba4ffc1f66b8d49e2866f5969e78b5165e3a43deeeff2a0871a18257dba99"
     },
     {
       "kind": "source",

scripts/deploy_vps.sh

@@ -226,7 +226,7 @@ if [ -n "${manifest_git_head}" ]; then
   if [ "${manifest_git_head}" = "${actual_head}" ]; then
     echo "git HEAD guard: exact match ✓"
   else
-    parent_head="$(git rev-parse HEAD~1 2>/dev/null || echo "")"
+    parent_head="$(git rev-parse --verify HEAD~1 2>/dev/null || echo "")"
     if [ -n "${parent_head}" ] && [ "${manifest_git_head}" = "${parent_head}" ]; then
       echo "git HEAD guard: parent match ✓ (manifest is 1 commit behind HEAD, normal)"
     elif [ -z "${parent_head}" ]; then