Make three fail-open lints fail loudly

check-attribution-trailers.sh: the origin/main fallback now fails
loudly if it cannot fetch/resolve origin/main, instead of silently
substituting HEAD~10 as the diff base.

check-comment-blocks.sh and check-issue-refs.sh: assert the tracked
file-list search matched at least one file before treating an empty
hit-set as clean, mirroring the existing assertion in
check-doc-refs.sh.

Refs 4442, fixes 4439

scripts/check-issue-refs.sh

@@ -28,6 +28,16 @@ set -eu
 
 pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)|/issues/[0-9]+([^0-9a-zA-Z]|$)'
 
+# A lint whose file-list matches nothing passes forever while checking not
+# one file — mirrors the assertion in scripts/check-doc-refs.sh. If a rename
+# or extension-list edit silences `git ls-files` here, that is a failure of
+# this script, not a property of the tree.
+file_count="$(git ls-files '*.rs' '*.nix' '*.js' '*.mjs' '*.ts' '*.tsx' '*.css' '*.html' '*.md' '*.yml' '*.yaml' | wc -l)"
+if [ "$file_count" -eq 0 ]; then
+  echo 'check-issue-refs: file-list search matched nothing — pattern or tree changed' >&2
+  exit 1
+fi
+
 # `/dev/null` forces grep to always print a filename prefix, even when
 # xargs hands it a single file. `-r`/`-0` keep it robust to odd paths and
 # an empty file list. Lines carrying the `lint:allow` marker are dropped