ref builders: failed git status is accepted as a clean source tree #265

The hidden, nemotron and clefvis builders put git status inside a test's command substitution. A corrupt or unreadable Git index makes status exit 128 with empty stdout. The test then treats the tree as clean. rev-parse HEAD does not need that index, so the scripts can compile unchecked headers and record the commit as their provenance. Validation reproduced exit 0 after a status stub returned 128; the standalone assignment exited 128. Capture git status in a standalone assignment before testing its output; set -e then stops on failure.

Evidence (at the base of #242):

• tools/ref/build-hidden.sh:21
• tools/ref/build-nemotron-ref.sh:19
• tools/ref/clefvis/build-clefvis.sh:31

_{Filed by Shingler, the review bot, while reviewing #242; the defect is outside that pull request.}