Disable Buildkite commit verification for google-bazel-presubmit (#2890)

New images pick up **Buildkite agent v4** (the agent is installed
unpinned from the apt `stable` channel / GitHub `releases/latest`).
Agent v4 defaults `git-commit-verification` to `strict`, which breaks
every `google-bazel-presubmit` job that lands on a new VM, e.g.
https://buildkite.com/bazel/google-bazel-presubmit/builds/110111:

```
$ git merge-base --is-ancestor 5f1bfb3f... 864445577c...
🚨 Error: commit verification failed: commit "5f1bfb3f..." is not on branch "master"
```

Those builds are created with `branch=master` but check out an
unsubmitted Gerrit change, which is never an ancestor of master. Agents
still on 3.137.0 pass, so failures are intermittent while old and new
VMs are mixed.

### Change
Set `BUILDKITE_GIT_COMMIT_VERIFICATION=off` for `google-bazel-presubmit`
only, in the agent `environment` hook on Linux
(`startup-docker-pdssd.sh`) and Windows (`startup-windows-pdssd.ps1`).

buildkite/startup-docker-pdssd.sh

diff --git a/buildkite/startup-docker-pdssd.sh b/buildkite/startup-docker-pdssd.sh
index 80f1735..6d89f8d 100644
--- a/buildkite/startup-docker-pdssd.sh
+++ b/buildkite/startup-docker-pdssd.sh
@@ -79,6 +79,13 @@
 #!/bin/bash
 set -euo pipefail
 export BUILDKITE_ARTIFACT_UPLOAD_DESTINATION="gs://${ARTIFACT_BUCKET}/\${BUILDKITE_JOB_ID}"
+# google-bazel-presubmit builds unsubmitted Gerrit changes with branch=master,
+# which never pass Buildkite agent v4's strict commit verification. This has to
+# be set from a hook: under the default checkout-override-mode (from-job), the
+# agent ignores BUILDKITE_GIT_COMMIT_VERIFICATION from pipeline/step env.
+if [[ "\${BUILDKITE_PIPELINE_SLUG:-}" == "google-bazel-presubmit" ]]; then
+  export BUILDKITE_GIT_COMMIT_VERIFICATION=off
+fi
 EOF
 
 ### 1. Capture Job Start Time

buildkite/startup-windows-pdssd.ps1

diff --git a/buildkite/startup-windows-pdssd.ps1 b/buildkite/startup-windows-pdssd.ps1
index 10dd724..30ffb42 100644
--- a/buildkite/startup-windows-pdssd.ps1
+++ b/buildkite/startup-windows-pdssd.ps1
@@ -44,6 +44,9 @@
 SET PATH=${env:PATH}

 SET TEMP=${env:TEMP}

 SET TMP=${env:TEMP}

+REM google-bazel-presubmit builds unsubmitted Gerrit changes with branch=master, which never

+REM pass Buildkite agent v4's strict commit verification. Pipeline env cannot override it.

+IF "%BUILDKITE_PIPELINE_SLUG%"=="google-bazel-presubmit" SET BUILDKITE_GIT_COMMIT_VERIFICATION=off

 "@

 [System.IO.File]::WriteAllLines("c:\buildkite\hooks\environment.bat", $buildkite_environment_hook)