The sync now merges the SHA it resolved from refs/remotes/upstream/main, not a ref name, so the hostile git shim matches that commit. (cherry picked from commit a18bd61d477cfb9763a4fa7c971239f8c6a4e4d3) (cherry picked from commit acc97addd46cde31e15e6a817b777acffcd10e8a)