At this point, without Git commit history (assuming it is a bare code dump), is it still even possible to guarantee it is what Google says it is?

You can compare against old dumps.