devops: fetch origin before sync-moxygen's containment check

[afrind]

The containment check only reads local refs, so a moxygen checkout sitting on a commit that has since been pushed upstream is named by nothing locally and the detach is refused even though it would cost nothing -- the common shape right after moxygen work lands and the pin moves on with it. Fetch origin first, so the check sees the remote refs that do name it.

Best effort and non-fatal: it runs after the dirty/in-progress checks (which refuse without touching the network) and only on a goto that actually moves the checkout, since the HEAD == pin fast path returns earlier.

---

This change is 

[gmarzot]

scripts/dev/sync-moxygen.sh line 90 at r1 (raw file):

# Not fatal. Offline, the checks below just run against the refs already here and the
# worst case is the conservative refusal they would have given anyway.
git -C "$dir" fetch --quiet origin 2>/dev/null || true

The change is correct and worth landing. Two things I'd ask for:

1. The silent failure discards the diagnostic. 2>/dev/null || true means a fetch that fails for any reason — offline, dead remote, credential prompt — leaves no trace. The user then hits the containment refusal with no hint it was decided on stale refs, which is precisely the confusion this PR exists to remove. Keep it non-fatal, but emit one line to stderr on failure so the refusal below is interpretable.

2. Credential prompt / hang on the hook path. The file header explicitly supports a post-checkout hook caller (sync-moxygen.sh || true). git fetch against a remote that wants credentials can block indefinitely, and a hook that hangs every git checkout is a bad failure. GIT_TERMINAL_PROMPT=0 on that one command closes it cheaply. This is the one I'd treat as near-blocking, since it only bites people whose remote setup differs from the author's — the classic "works on my machine" shape.

Two smaller notes:

3. --prune cuts the other way, and it's a real decision. Without it, a deleted remote branch leaves a stale refs/remotes/origin/X locally, which can make containment pass for a commit that's no longer on the server — a false reassurance in the direction that loses work. The script's stated philosophy is refusing exactly what detaching would cost, which argues for accuracy in both directions. --prune makes it stricter and occasionally more annoying. Not obviously right, but worth being deliberate rather than defaulted.

4. The description slightly undersells the cost. "not per-goto traffic" is true — the HEAD == pin fast path returns first. But among gotos that do move, some previously needed no network at all, because the pin was already local from an earlier sync. Now every move fetches. Trivial for a repo this size; just not quite "no new traffic".

Optionally: ten lines of comment for one line of code, and much of it is "not before / Not fatal / not per-goto". Since the house standard is saying what the code does rather than what it isn't, it could compress to about three. Low priority and consistent with the file's existing voice, so take it or leave it.

[gmarzot]

@gmarzot reviewed 1 file and all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on afrind).