task image: remove git history after HEAD on the Phase 1 template branch

[ArjunS07]

Purpose

Phase 1 builds task images from survey/phase1-template-20261008. That branch does not have datasmith#46, which removes git history after the base commit at image build. This PR applies the same two commits to that branch, so new Phase 1 images come out clean without the separate scrub step.

How it works

src/datasmith/harbor_adapter/
├── adapter.py                        # copies scrub_git.sh next to entrypoint.sh
└── template/environment/
    ├── Dockerfile                    # runs scrub_git.sh as the last step
    └── scrub_git.sh                  # new
src/datasmith/docker/templates/docker_build_run.sh   # the ref check can fail the build
tests/docker/test_scrub_git.py        # new

Changes

1. The task image removes git history after HEAD.
   Effect: the last build step deletes refs that are not ancestors of HEAD, expires reflogs and prunes unreachable objects. The build fails if HEAD, the tree, git describe or git status change, or if a later commit is left.
   Before: on this branch, new images keep the history until aws/scrub_worker.py adds the scrub layer.
2. The ref check in docker_build_run.sh can fail.
   Effect: a ref ahead of HEAD stops the build.
   Before: the check ended the build script with success, so it never failed.

Verification

• pytest tests/docker/test_scrub_git.py tests/docker/test_harbor_adapter_render.py tests/docker/test_setup_baseline_commit.py: 5 passed.
• The same script passed on networkx 8138, numpy 21464 and dask 11754 images in datasmith#46.

Notes

• Same commits as datasmith#46 (58b1b2e, 4cddd54), cherry-picked without changes.
• It changes render_source_sha256. Timing does not change, because HEAD and the tree stay the same.
• Images that already have the scrub layer do not need a rebuild.