Fetch history and tags in the canonical workflow (closes #110)

The checkout step of the canonical `.gitea/workflows/check.yml` now sets `fetch-depth: 0`, with a one-line comment saying why. The checkout action otherwise clones shallow with no tags, so `git describe --tags --always` gave a bare short commit id in CI where a local build of a tagged repository gives the tag. `REPO_POLICIES.md` and both checklists now name `fetch-depth: 0` among what the workflow does, next to `persist-credentials: false` and the `concurrency` block, where they used to ask each tagged repository to add it.

Unverified: the live check, which waits on the shared runner.

Model: opus-5-5

TODO.md

@@ -21,6 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
+  `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
+  and tags that `git describe --tags --always` needs, and a tagged repository
+  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
+  checklists name `fetch-depth: 0` among what the workflow does, next to
+  `persist-credentials: false` and the `concurrency` block, instead of asking
+  each tagged repository to add it. Not yet tried on the shared runner, which is
+  out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
   before the first `apt-get install` of a run (issue 115). The Gitea runner
   image starts with empty package lists, so installing anything it lacks, such