[dependabot:release-train-updater] create_pull_request safe output fails with false no commits found on verified-clean committed branches

`create_pull_request` safe output fails with `"No changes to commit - no commits found"` even when a valid, committed, non-empty diff exists on top of the checked-out branch. This has now recurred at least 4 times across dependabot-release-train-updater runs on 2026-09-14 (cache-memory entries `dependabot-release-train-2026-09-14-10-33-40.md`, `-11-30-00.md`, `-11-37-55.md`, and this run), always for the same candidate change: bumping `actions/checkout` v6→v7.0.1 and `actions/setup-node` v4→v7.0.0 in `enterprise-canary.yml`, `enterprise-stress.yml`, `review-smoke.yml`, and `workflow-contracts.yml`.

### Reproduction (this run)

1. Workspace root checkout: `origin` = `https://github.com/githubnext/gh-aw-cao.git`, `HEAD` on `main` at `56e7a4e1`, repository **not** shallow.
2. Created branch `dependabot-agent/actions-checkout-setup-node-2026-09-14` (matches the required `dependabot-agent/*` allowed-branch pattern).
3. Edited the 4 workflow files (pin bumps only), staged exactly those files, committed successfully:
- `git log --oneline -1` → `53985d06 Bump actions/checkout to v7.0.1 and actions/setup-node to v7.0.0`
- `git cat-file -t HEAD` → `commit` (valid object)
- `git diff origin/main..HEAD --stat` → shows the expected 4-file, 10-insertion/10-deletion diff
- `git merge-base HEAD origin/main` → `56e7a4e1...` (a real, non-empty ancestor relationship — HEAD is exactly one commit ahead of `origin/main`)
4. Called `create_pull_request` (via `safeoutputs create_pull_request`) with `branch: "dependabot-agent/actions-checkout-setup-node-2026-09-14"`.
5. Result: `{"result":"error","error":"No changes to commit - no commits found", ...}` despite the commit and merge-base evidence above proving a real, resolvable diff exists.

### Why this looks like a tool-side bug, not a diff problem

- The commit is real (`git cat-file -t HEAD` returns `commit`), non-empty, and has a proper linear ancestor relationship to `origin/main` (`git merge-base` succeeds and returns the immediate parent commit, not empty/error).
- The exact same class of failure was reported in three prior runs today, each with a different, independently-valid diff (eslint/package.json edits, and this checkout/setup-node bump attempted at least twice more before this run), ruling out any single diff's content as the cause.
- A subsequent run on 2026-09-14 (cache-memory entry `-11-37-55.md`) hypothesized the failure was caused by a checkout/target-repo mismatch (i.e. workspace root pointing at a different repo than the dispatch's `target_repo`), but this run's workspace root does correctly point at `githubnext/gh-aw-cao` (matching `target_repo` in `control-precompute.json`), and the failure still reproduced — so that specific mismatch theory does not fully explain the bug either.

### Suggested remediation

- Add server-side diagnostic logging in the `create_pull_request` safe-output handler (or the underlying bundle-generation script, e.g. `generate_git_bundle.cjs`) that reports *why* it considers "no commits found" — e.g. print the computed merge-base, the branch names being diffed, and whether a bundle was actually attempted — so future failures are debuggable without needing external hypothesis-testing across multiple runs.
- Consider surfacing a clearer error distinguishing "bundle generation failed due to no common ancestor" from "the working tree truly has no new commits," since these currently produce the same misleading message.

### Ready-to-reapply diff (once tool is fixed)

The following 4-file, minimal diff is fully validated (YAML-parses cleanly, SHA pins verified against `actions/checkout@v7.0.1` = `3d3c42e5aac5ba805825da76410c181273ba90b1` and `actions/setup-node@v7.0.0` = `820762786026740c76f36085b0efc47a31fe5020` via the GitHub API) and can be reapplied verbatim once `create_pull_request` is working again:

- `.github/workflows/enterprise-canary.yml`: `actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6` → `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`
- `.github/workflows/enterprise-stress.yml`: same checkout bump
- `.github/workflows/review-smoke.yml`: same checkout bump
- `.github/workflows/workflow-contracts.yml`: same checkout bump (x3 occurrences) + `actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4` → `actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0` (x3 occurrences)

### Control Plane

- Correlation ID: 34844100935-279
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34844100935

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34844663427) · copilot · auto · 73.3 AIC · ⌖ 10 AIC · ⊞ 18.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

> - [x] expires on Sep 28, 2026, 12:49 PM UTC

Start with the create_pull_request safe-output handler and the underlying generate_git_bundle.cjs script mentioned in the report. Reproduce the failure using the documented committed branch and diff, then inspect how merge-base, branch names, and bundle attempts are handled. Done means valid committed diffs no longer produce the misleading no-commits error, with diagnostics distinguishing the reported failure cases.

Written by the indexing model from the issue text.