Simple fix for an interesting statistical problem

The there's-no-trampoline problem struck again when running against
the linux kernel. It's currently catastrophic to do text object-id
substitution against something that's way in our future. The linux
kernel has 1/3 million commits, and this apparently means that
matching against a hex string size of 8 characters is too small.

Problem Statement:

We have a repository with C commits. Each commit has an unique
identifier ('commit id') and a commit message written by a human
author, leading to a total corpus of text that is roughly
proportional to C in size.

Hexadecimal strings are spread thoughout this body of text. Some are
commit ids but others are effectively random numbers that reference
things unrelated to what we are in intereseted in - they may exactly
correspond to abbreviated commit ids, but that was not the intention
of the author. Commit ids are referred to relatively infrequently,
perhaps once every 100 commits or so.

We search the corpus of text for these hexadecimal strings, and
examine each one to see if we think they really are commit ids.
If so, we perform a translation operation on them - it is
VERY IMPORTANT that we DO NOT perform this operation on a hex string
that was not intended to be a commit id.

We only consider hexadecimal strings of a length L or greater. We
test each hex-string to see if it corresponds to an abbreviated
version of a unique commit of the C commits in the repository,
and only then perform the operation it, but beyond that there is
no way to test if the author intended it as a commit id.

What minimum length L should we choose for a repository of C commits
such that we have confidence P that we will not make this mistake
during the processing of the repository?