Make three fail-open lints fail loudly

check-attribution-trailers.sh: the origin/main fallback now fails
loudly if it cannot fetch/resolve origin/main, instead of silently
substituting HEAD~10 as the diff base.

check-comment-blocks.sh and check-issue-refs.sh: assert the tracked
file-list search matched at least one file before treating an empty
hit-set as clean, mirroring the existing assertion in
check-doc-refs.sh.

Refs 4442, fixes 4439

scripts/check-attribution-trailers.sh

@@ -28,7 +28,10 @@ if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
   git fetch origin "$branch" 2>/dev/null || true
   if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
     base="origin/main"
-    git fetch origin main 2>/dev/null || base="HEAD~10"
+    if ! git fetch origin main 2>/dev/null || ! git rev-parse --verify "$base" >/dev/null 2>&1; then
+      echo 'check-attribution-trailers: base ref unresolvable — cannot fetch origin/main to diff against, refusing to guess a commit range' >&2
+      exit 1
+    fi
   fi
 fi
 

scripts/check-comment-blocks.sh

@@ -20,6 +20,16 @@ set -eu
 
 MAX=30
 
+# A lint whose file-list matches nothing passes forever while checking not
+# one file — mirrors the assertion in scripts/check-doc-refs.sh. If a rename
+# or extension-list edit silences `git ls-files` here, that is a failure of
+# this script, not a property of the tree.
+file_count="$(git ls-files '*.rs' '*.nix' '*.sh' '*.js' '*.mjs' '*.ts' '*.tsx' '*.css' '*.html' | wc -l)"
+if [ "$file_count" -eq 0 ]; then
+  echo 'check-comment-blocks: file-list search matched nothing — pattern or tree changed' >&2
+  exit 1
+fi
+
 # Collect annotations into a variable (not via xargs/awk exit codes) so a
 # hit in any xargs batch is preserved — mirrors scripts/check-issue-refs.sh.
 hits="$(

scripts/check-issue-refs.sh

@@ -28,6 +28,16 @@ set -eu
 
 pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)|/issues/[0-9]+([^0-9a-zA-Z]|$)'
 
+# A lint whose file-list matches nothing passes forever while checking not
+# one file — mirrors the assertion in scripts/check-doc-refs.sh. If a rename
+# or extension-list edit silences `git ls-files` here, that is a failure of
+# this script, not a property of the tree.
+file_count="$(git ls-files '*.rs' '*.nix' '*.js' '*.mjs' '*.ts' '*.tsx' '*.css' '*.html' '*.md' '*.yml' '*.yaml' | wc -l)"
+if [ "$file_count" -eq 0 ]; then
+  echo 'check-issue-refs: file-list search matched nothing — pattern or tree changed' >&2
+  exit 1
+fi
+
 # `/dev/null` forces grep to always print a filename prefix, even when
 # xargs hands it a single file. `-r`/`-0` keep it robust to odd paths and
 # an empty file list. Lines carrying the `lint:allow` marker are dropped