Fix: Verify the initial Panama revision

tests/setup/root-server-bootstrap-contract

@@ -36,6 +36,10 @@ boot = sys.argv[1]
 work = Path(tempfile.mkdtemp())
 atexit.register(shutil.rmtree, work, ignore_errors=True)
 findings: list[str] = []
+BOOT_REVISION = "0123456789abcdef0123456789abcdef01234567"
+BOOT_SHA256 = subprocess.run(
+    ["sha256sum", boot], check=True, capture_output=True, text=True
+).stdout.split()[0]
 
 
 def note(message: str) -> None:
@@ -145,12 +149,42 @@ exec /usr/bin/ssh-keygen "$@"
     write_executable(stub_dir / "git", common + r'''
 log git "$@"
 case "${1:-}" in
-  clone)
-    mkdir -p "$3/.git"
-    cp "$PANAMA_BOOT_FIXTURE_ROOT/stub-install" "$3/install"
-    chmod +x "$3/install"
+  init)
+    [[ "$#" -eq 2 ]] || exit 97
+    mkdir -p "$2/.git"
+    ;;
+  -C)
+    case "${3:-}" in
+      remote)
+        [[ "$#" -eq 6 && "$4" == add && "$5" == origin \
+          && "$6" == https://git.gbrown.org/gib/Panama.git ]] || exit 97
+        ;;
+      fetch)
+        [[ "$#" -eq 6 && "$4" == --depth=1 && "$5" == origin \
+          && "$6" == "$PANAMA_BOOT_REVISION" ]] || exit 97
+        ;;
+      checkout)
+        if [[ "${4:-}" == --detach ]]; then
+          [[ "$#" -eq 5 && "$5" == "$PANAMA_BOOT_REVISION" ]] || exit 97
+          cp "$PANAMA_BOOT_FIXTURE_ROOT/stub-install" "$2/install"
+          chmod +x "$2/install"
+        else
+          [[ "$#" -eq 5 && "$4" == -b && "$5" == main ]] || exit 97
+        fi
+        ;;
+      rev-parse)
+        [[ "$#" -eq 4 && "$4" == 'HEAD^{commit}' ]] || exit 97
+        printf '%s\n' "$PANAMA_BOOT_REVISION"
+        ;;
+      config)
+        case "${4:-}:${5:-}:${6:-}" in
+          branch.main.remote:origin:|branch.main.merge:refs/heads/main:) ;;
+          *) exit 97 ;;
+        esac
+        ;;
+      *) exit 97 ;;
+    esac
     ;;
-  -C) [[ "${3:-}" == pull && "${4:-}" == --ff-only ]] || exit 97 ;;
   *) exit 97 ;;
 esac
 ''')
@@ -483,6 +517,8 @@ def run_case(
         **os.environ,
         "PATH": f"{stub_dir}:/usr/bin:/bin",
         "PANAMA_BOOT_FIXTURE_ROOT": str(fixture_root),
+        "PANAMA_BOOT_REVISION": BOOT_REVISION,
+        "PANAMA_BOOT_SHA256": BOOT_SHA256,
         "PANAMA_PATH": f"{fixture_root}/home/gib/.local/share/Panama",
         "HOME": f"{fixture_root}/root",
     }
@@ -586,6 +622,8 @@ guard_root.mkdir()
 guard_env = {
     **os.environ,
     "PANAMA_BOOT_FIXTURE_ROOT": str(guard_root),
+    "PANAMA_BOOT_REVISION": BOOT_REVISION,
+    "PANAMA_BOOT_SHA256": BOOT_SHA256,
     "HOME": str(guard_root),
 }
 if os.geteuid() == 0: