sync: the forge being ahead of GitHub is not a divergence

ff-main has been red every ten minutes. Eleven consecutive failures in the
hour I read it, and not one of them a divergence: the branch asked only
"is LOCAL an ancestor of REMOTE" and called every other answer DIVERGED,
so the forge simply being AHEAD of GitHub took the loud-failure path.

That is the normal state after every native push, and it is not brief --
the push-mirror is sync_on_commit with an 8h floor, so one commit can
produce up to 48 false alarms before GitHub catches up.

The cost is not the noise. A job that is always red cannot report the one
thing it exists to report, and this job's whole value is refusing to
force-push a real divergence. The loud failure is worth keeping only if it
is rare.

Four sibling repos (app, git, hanzo.ai, iam) already carry exactly this
two-direction check; id had the stale copy. Same logic, same order --
this is convergence onto the estate's answer, not a new one. HIPs,
mirrors and python-sdk are still stale and are being fixed with it.

Exercised against real git ancestry, all four states:

  state          old              new
  equal          in-sync(0)       in-sync(0)
  github-ahead   fast-forward(0)  fast-forward(0)
  native-ahead   DIVERGED(1)      native-ahead(0)   <- the fix
  diverged       DIVERGED(1)      DIVERGED(1)       <- alarm preserved

One row moves. The genuine-divergence alarm still fires, which is what
keeps this a fix rather than a mute button.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/sync-from-github.yml

@@ -60,8 +60,33 @@ jobs:
               -H "Content-Type: application/json" \
               "${{ github.server_url }}/v1/repos/${{ github.repository }}/actions/workflows/cicd.yml/dispatches" \
               -d '{"ref":"main"}' || echo "build dispatch failed (non-fatal)"
+          elif git merge-base --is-ancestor "$REMOTE" "$LOCAL"; then
+            # Native is AHEAD of GitHub. This is the NORMAL state for the whole
+            # window between a native push and the push-mirror carrying it over,
+            # and that window is long: the mirror is sync_on_commit with an 8h
+            # floor, so it can legitimately last hours.
+            #
+            # It used to land in the `else` below, because that branch asked only
+            # "is LOCAL an ancestor of REMOTE" and called every other answer a
+            # divergence. So every native commit produced up to 48 consecutive
+            # DIVERGED failures, ten minutes apart, describing a repository that
+            # was in exactly the state this design intends. 11 of them were red on
+            # the hour I read them, none of them a real divergence.
+            #
+            # The cost is not the noise, it is what the noise hides: a job that is
+            # always red cannot report the one thing it exists to report. The loud
+            # failure below is worth keeping ONLY if it is rare.
+            #
+            # There is nothing to pull here and nothing to fix. Do NOT push native
+            # to GitHub from this job — that is the push-mirror's single direction,
+            # and duplicating it is how two writers start racing one destination.
+            echo "native is ahead at $LOCAL; GitHub at $REMOTE will follow via the push-mirror"
+            exit 0
           else
-            echo "DIVERGED: native $LOCAL is not an ancestor of GitHub $REMOTE." >&2
+            # Genuine divergence: neither ref contains the other, so a commit
+            # exists on each side that the other has never seen. Nothing can be
+            # fast-forwarded and either direction would destroy history.
+            echo "DIVERGED: native $LOCAL and GitHub $REMOTE share no ancestry line." >&2
             echo "Resolve by hand; this job will not force-push either side." >&2
             exit 1
           fi