The unchosen stable default is forward-only, but _head_containing treated
`merge-base --is-ancestor` exit 1 as proof HEAD lacks the release. In a
shallow clone that exit is a guess at the history boundary, so a checkout
already past v0.21.6 was "updated" back to it; an unreachable GitHub
compare did the same. Only proof (exit 1 on full history, or GitHub
saying behind/diverged) moves the checkout now; unknown keeps HEAD.
dce1e9b375