fix(ceo): handle unreachable last-synced SHA in heartbeat sync

If the repo was force-pushed or shallow-cloned, the saved SHA may no
longer exist. Detect this and fall back to a full resync instead of
failing silently.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

ceo/HEARTBEAT.md

@@ -85,6 +85,12 @@ This repo (`/paperclip/privilegedescalation/agents`) is the canonical source of
     LAST_SHA=$(cat /paperclip/privilegedescalation/agents/ceo/.last-synced-sha 2>/dev/null || echo "")
     CURRENT_SHA=$(git -C /paperclip/privilegedescalation/agents rev-parse HEAD)
 
+If `LAST_SHA` is non-empty, verify it still exists in the local history (it may be gone after a force-push or shallow clone):
+
+    if [ -n "$LAST_SHA" ] && \! git -C /paperclip/privilegedescalation/agents cat-file -e "$LAST_SHA" 2>/dev/null; then
+      LAST_SHA=""  # unreachable — treat as full resync
+    fi
+
 If `LAST_SHA` is empty or equals `CURRENT_SHA`, skip to step 5. Otherwise:
 
     git -C /paperclip/privilegedescalation/agents diff "$LAST_SHA".."$CURRENT_SHA" --name-only