fix(nix/buildkite): prevent swallowing errors from git-merge-base

The `local` usage we had before would silently swallow non-zero exit
statuses from the substituted git commands.

For some (as of yet unknown) reason, `git merge-base` seems to
sometimes silently fail and produce no output, which broke the rest of
the script logic.

This change will lead to an earlier error, but we don't know if it is
a fix for the actual cause of the git-merge-base problem because the
shape of that problem is unclear.

Change-Id: I4555c8638da450263fa2fd2c274dfdb69f65578e
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5012
Tested-by: BuildkiteCI
Reviewed-by: kn <klemens@posteo.de>

nix/buildkite/fetch-parent-targets.sh

@@ -15,12 +15,14 @@ set -ueo pipefail
 
 : ${DRVMAP_PATH:=pipeline/drvmap.json}
 
-function most_relevant_builds {
-    git fetch -v origin "${BUILDKITE_PIPELINE_DEFAULT_BRANCH}"
-    local FIRST=$(git merge-base --fork-point HEAD FETCH_HEAD)
-    local SECOND=$(git rev-parse "$FIRST~1")
-    local THIRD=$(git rev-parse "$FIRST~2")
+git fetch -v origin "${BUILDKITE_PIPELINE_DEFAULT_BRANCH}"
 
+FIRST=$(git merge-base --fork-point FETCH_HEAD "${BUILDKITE_COMMIT}")
+SECOND=$(git rev-parse "$FIRST~1")
+THIRD=$(git rev-parse "$FIRST~2")
+
+function most_relevant_builds {
+    set -u
     curl 'https://graphql.buildkite.com/v1' \
          --silent \
          -H "Authorization: Bearer $(cat /run/agenix/buildkite-graphql-token)" \