feat(repos): git-fingerprint-based machine-independent repo identity

Add git_fingerprint (root commit SHA-1) to managed_repos as a stable,
machine-independent identifier — identical across every clone regardless
of checkout path, remote URL, or SSH alias.

- Migration n1i2j3k4l5m6: adds git_fingerprint column + non-unique index
  (non-unique to support repos that share ancestry via forks/splits)
- GET /repos/by-fingerprint?hash=<sha>[&remote_url=<url>]: lookup by
  fingerprint; optional remote_url disambiguates shared-ancestry repos
- GET /repos/by-remote?url=<url>: fallback lookup by remote URL
- consistency_check.py --here [PATH]: auto-detects repo slug from any
  local checkout via fingerprint (falls back to remote URL), then auto-
  registers host_paths[hostname] so subsequent runs need no override
- --all now includes repos with host_paths[current_hostname], not just
  those with local_path
- fix-consistency-here / check-consistency-here Makefile targets
- Fixed _api_get bug: httpx strips query strings when params={} is passed
- Backfilled fingerprints for 14 repos on this host

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/versions/n1i2j3k4l5m6_add_git_fingerprint_to_repos.py

@@ -0,0 +1,39 @@
+"""Add git_fingerprint to managed_repos
+
+Stores the root commit SHA-1 of the git repository — a machine-independent
+identifier that is identical across every clone regardless of remote URL,
+checkout path, or protocol.  Used by the consistency checker and other tools
+to match a locally checked-out repo to its state-hub record without relying
+on local_path or remote_url (both of which vary per machine).
+
+Revision ID: n1i2j3k4l5m6
+Revises: m0h1i2j3k4l5
+Create Date: 2026-03-28
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'n1i2j3k4l5m6'
+down_revision = 'm0h1i2j3k4l5'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        'managed_repos',
+        sa.Column('git_fingerprint', sa.String(40), nullable=True),
+    )
+    # Non-unique index: repos forked from the same ancestor share a root commit
+    # SHA-1.  The index speeds up lookup; disambiguate by remote_url when needed.
+    op.create_index(
+        'ix_managed_repos_git_fingerprint',
+        'managed_repos',
+        ['git_fingerprint'],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index('ix_managed_repos_git_fingerprint', table_name='managed_repos')
+    op.drop_column('managed_repos', 'git_fingerprint')