fix: restore CI (2g ceiling was OOM-killing tsc), plus the two Vapron display fixes #5563

⚠️ CI on this branch is red, and this PR is the fix for why. Explained below — please read before merging.

The deadlock

The mem_limit: 2g merged in #5562 is OOM-killing the build:

==> Typecheck
$ bunx tsc --noEmit
[exit 137 in 7611ms]

137 = 128 + 9 = SIGKILL. The workflow runner executes inside the app container, so the app's memory bound also bounds every typecheck and test run. I set that ceiling from the app's steady-state numbers and never accounted for the build peak — a full typecheck of ~400 files needs well above it.

This PR raises it to 4g. It cannot go green, because CI runs in the container the 2g limit is currently constraining. The change that fixes CI has to pass a CI broken by the thing it fixes.

Verified locally instead: bun run typecheck clean, 39 tests green across the touched suites. The red run reports zero test failures — the process was killed before it could report any.

4g still bounds what the limit was added for: the container was at 526 MB and climbing, having written five 10–13 GB core dumps onto a shared disk. The bound was right; the number was wrong.

Also in here — the two defects that made Vapron look dead for a day

The repo page read "Updated 6d ago" while ~30 branches merged into it. Two independent causes, both ours:

1. default_branch stored lowercase. The row said main; the actual branch is Main. git rev-parse main fails, so every read resolved a branch that does not exist and the repo rendered empty. No error anywhere — the symptom is a repo that looks dead. Import now reads the clone's actual symbolic HEAD instead of defaulting to the literal "main" and trusting the caller. Class-wide: any repo with a capitalised default branch had the same silent fault.

2. pushed_at cannot see most pushes. It is written by the post-receive hook, which only runs on paths that go through the app. Anything writing refs directly into the bare repo — system sshd, a push run on the box, an admin fix — changes the repository and never tells the database. On this deployment that is not an edge case: the in-app SSH server is off (SSH_PORT=0 since the 2026-08-22 inbound-TCP incident), so direct-to-disk is the only SSH path there is.

Not fixed with another hook — a hook only covers paths that reach the app, and the path that caused this does not. "Updated N ago" is now derived from git: newest commit across refs/heads, whichever is newer wins, and the column heals on the way past. Git wins only when newer, deliberately — a repo can hold commits older than its last push (force-push to an earlier commit, import of old history), and overwriting there would move a live repo's date backwards.

Recognising the OOM next time

CI red · exit 137 · no test failures listed. The log looks like nothing went wrong, which is the same shape as everything else this audit has been finding: a failure that reports as silence.

🤖 Generated with Claude Code