Test: Prove verified bootstrap boundaries

tests/setup/boot-contract

@@ -64,8 +64,12 @@ case "\${1:-}" in
           [[ "\$#" -eq 5 && "\$5" == "$revision" ]] || exit 97
           cp "$work/fake-install" "$clone_dir/install"
           chmod +x "$clone_dir/install"
+          printf '%s\n' '$revision' >"$clone_dir/.git/HEAD"
         elif [[ "\${4:-}" == -b ]]; then
           [[ "\$#" -eq 5 && "\$5" == main ]] || exit 97
+          mkdir -p "$clone_dir/.git/refs/heads"
+          printf '%s\n' '$revision' >"$clone_dir/.git/refs/heads/main"
+          printf 'ref: refs/heads/main\n' >"$clone_dir/.git/HEAD"
         else
           exit 97
         fi
@@ -196,6 +200,22 @@ grep -qF "install PANAMA_PATH=$clone_dir" "$calls" \
 grep -qE '^git (clone|.* pull)' "$calls" \
     && note 'fresh bootstrap used mutable clone or pull behavior'
 
+# A fresh fetch failure stops before any checked-out HEAD or executable
+# handoff exists. The empty initialized Git directory is not a usable checkout.
+configure_case fresh-fetch-failure
+run_boot "$revision" "$boot_sha"
+(( run_status != 0 )) || note 'fresh fetch failure returned success'
+grep -qF "git -C $clone_dir fetch --depth=1 origin $revision" "$calls" \
+    || note 'fresh fetch failure did not exercise the exact fetch'
+assert_no_install_or_rewrite 'fresh fetch failure'
+if grep -qE '^git .* (checkout|rev-parse)($| )' "$calls"; then
+    note 'fresh fetch failure reported or materialized a checked-out HEAD'
+fi
+if [[ -x "$clone_dir/install" || -e "$clone_dir/.git/HEAD" \
+    || -e "$clone_dir/.git/refs/heads/main" ]]; then
+    note 'fresh fetch failure left a usable checkout'
+fi
+
 # A fetched checkout whose HEAD does not equal the requested commit never
 # creates the trusted branch or reaches install.
 configure_case head-mismatch "$mismatched_revision"