gate: no commit by a test identity

.github/workflows/ci.yml

@@ -29,6 +29,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # The gate's testidentity reads the branch's commits since origin/main, which a pull
+          # request's shallow checkout does not have.
+          fetch-depth: 0
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       # No store cache: a package restored from one is never asked of the registry, so Socket
       # Firewall, which stands between the two, would not see it.

Taskfile.yml

@@ -100,11 +100,14 @@ tasks:
       - gh release upload {{.TAG}} --clobber {{.RELEASE}}/*
 
   gate:
-    desc: What holds the repository's shape - every install through the firewall, and every workflow step a task.
+    desc: What holds the repository's shape - every install through the firewall, every workflow step a task, and no commit since origin/main by a test's identity.
     cmds:
       - sfw check
       # The Task running this one, which taskgate asks for the task names.
       - taskgate -task {{.TASK_EXE}}
+      # A test that writes git's author into the checkout makes every commit after it the
+      # test's; this refuses those commits before they reach main.
+      - testidentity -base origin/main
 
   ci:
     desc: What CI's Gate job runs - the gate, the install, lint, typecheck, the unit tests, and the package.