fix(ci): give push builds the parent commit their audits diff against

Push builds fail the migration audit:

    ✗ Migration safety check could not run.
      Cannot diff against 'HEAD~1'.

`actions/checkout` sets no `fetch-depth`, so it defaults to 1 — a single-commit
clone in which `HEAD~1` does not resolve. Both diff-based audits name `HEAD~1`
as their base on push events, so neither has ever had a base to read.

The migration audit used to answer that with `✓ No new migrations to check` and
exit 0, so it had never run on a push build at all; #7022 made it say it could
not run instead, which is what surfaced this. The block-registry check has the
same input and reports `⚠ … skipping` — visible, but also never run on push.

`fetch-depth: 2` on the audit job's checkout gives `HEAD~1` something to name.
Verified in a two-commit repo: at depth 1 `git rev-parse HEAD~1` does not
resolve, at depth 2 it does and `git diff HEAD~1 HEAD` reports the change. Both
audits pass against `HEAD~1` on a checkout with history.

Only the audit job changes; Build App keeps its depth-1 checkout.

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -14,8 +14,16 @@ jobs:
     timeout-minutes: 15
 
     steps:
+      # The diff-based audits below name `HEAD~1` as their base on push events,
+      # and the default depth of 1 clones a single commit with no parent for that
+      # to resolve to. The migration audit read the resulting `git diff` failure
+      # as "no migrations changed" and exited 0, so it had never actually run on
+      # a push build; it now reports that it cannot run, which is what surfaced
+      # this.
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 2
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2