[#2079] Fetch commit metadata via SHA-only partial clone on tmpfs

## Parent

https://github.com/kernelci/dashboard/issues/2079
Schema: https://github.com/kernelci/dashboard/issues/2089

Library: `(hash, url?)` → commit metadata or a typed error. **No DB writes.** Git is ephemeral (tmpfs scratch dir, e.g. `GIT_SCRATCH_DIR`); wipe when done. Postgres is the store.

## Scope

Metadata for **one** commit. This is **not** the fill path for `commits`: it returns no ancestry, so do not loop it over every checkout hash, and do not recurse it over parent hashes to build history (one fetch negotiation per commit).

Bulk ancestry is the sync job's problem — persistent treeless repo, fetch refs, ingest in topological order — and lives in its own issue.

Use this helper for hashes the sync job cannot cover: trees we do not mirror, one-off gaps, odd or private remotes.

## Output

- `git_commit_hash`
- author / committer: name, email, date
- `subject`, full `message`
- `parent_hashes` — ordered; first = first parent

Parent hashes are read from the child object. Do not fetch parent objects.

No `fetched_from_url`: the repo we happened to read from is a property of the fetch, not of the commit ([#2079](https://github.com/kernelci/dashboard/issues/2079) discussion). Log it in the job if we want provenance.

## Fetch

Throwaway bare repo on the scratch path:

`git fetch --no-tags --depth=1 --filter=tree:0 origin `

Then `cat-file` / `log -1`, then delete the repo.

`--depth=1` is required. `--filter=tree:0` filters **trees and blobs, not commits** — without the shallow flag, fetching `` brings its whole ancestor commit chain (this is why treeless clones still carry full history), and an ephemeral repo would re-download that chain on every call. Shallow plus the filter is what actually yields one commit and no trees.

Do **not** full-clone, do **not** fetch all refs, and do **not** use `--depth=1` without the filter (that still pulls the tip's tree). If the remote ignores the filter or the shallow request and sends a full pack, fail and wipe.

Parsing must also be callable against an existing repo path, with no fetch, so the sync job can reuse it instead of duplicating commit-format parsing.

## URL resolution

If no URL is passed, pick one from `checkouts` for that hash (prefer maestro / `git.kernel.org`). Reuse treeproof-style cleanup. Malformed URLs ([#1952](https://github.com/kernelci/dashboard/issues/1952) / [#1953](https://github.com/kernelci/dashboard/issues/1953)) must not crash.

Applies to this helper only. The sync job takes its remotes from a tree list, not from checkout rows.

## Tests

Fixture parse (author, committer, subject, ordered parents). Parse against a pre-existing repo path with no fetch. Mock fetch failure, oversized / full pack, bad URL.