pipeline 2.2.1

Patch: reference-check accepts arbitrary git refs (SHA, branch, tag).
The 2.2.0 release used git clone --branch which rejects SHA refs,
breaking the canonical dog-food pattern of reference_ref:
$CI_COMMIT_SHA. Fix replaces the clone with init + remote add +
fetch <ref> + checkout FETCH_HEAD.