v2 changed-file discovery includes base-branch drift from PR merge checkout

[petyosi]

Summary

The v2 action's local changed-file fast path can treat base-branch drift as pull-request changes. This happens when actions/checkout checks out GitHub's synthetic pull-request merge ref while the action compares the event's base SHA against HEAD.

Minimal reproduction

Using React Doctor action v2.2.2 and CLI 0.7.4:

1. Create a pull request whose head is H and whose event base SHA is B0.

2. Advance the base branch to B1 with unrelated React changes.

3. Let GitHub check out the synthetic merge commit M = merge(B1, H).

4. Run the action's changed-file command:

   git diff --name-only --diff-filter=AMR B0...HEAD

Because HEAD is M, the result includes unrelated changes introduced between B0 and B1. Comparing B0...H instead contains only changes introduced by the pull request.

Expected behavior

The local changed-file list should contain only changes introduced by the pull request, even when the checked-out synthetic merge ref contains newer base-branch commits.

Suggested fix

When the checkout is a synthetic merge ref, derive the comparison from the pull-request head SHA or identify its head parent. Alternatively, use GitHub's pull-request files API.

A repository-level workaround is to check out the contributor head before running React Doctor:

- uses: actions/checkout@v5
  with:
    ref: ${{ github.event.pull_request.head.sha }}
    fetch-depth: 0

[react-doctor-evals]

✅ Triage opened a PR: #1447 — trace 1a42d4a1e2f58067ab6688efd73b47de