fix(ci): checkout PR head SHA so fork PRs resolve

[ciotlosm]

Problem

The validate job in .github/workflows/pr-check.yml fails on fork PRs at the very first step (Checkout PR branch) with:

A branch or tag with the name '<branch>' could not be found

The shared pr-check reusable workflow from n3ary/actions (ASCII-only check, Standards drift check) handles fork PRs correctly — it ran and passed on #486. Only the repo-local validate job was affected.

Root cause

The validate job's checkout used:

ref: ${{ inputs.branch || github.head_ref }}

github.head_ref is the branch name on the head repo. For fork PRs that name lives on the fork (e.g. valeboth/app), not on n3ary/app. With repository defaulting to the base repo, actions/checkout does git fetch origin refs/heads/<name> and finds nothing — GITHUB_TOKEN has no access to fork branches by name.

The shared pr-check avoids this by relying on actions/checkout's default fork-aware checkout (no explicit ref).

Fix

Switch to github.event.pull_request.head.sha. The PR commit SHA resolves via the magic ref refs/pull/<N>/head on the base repo, which GITHUB_TOKEN can read. This works for fork and same-repo PRs alike.

The workflow_dispatch path (manual rerun from the Actions UI) still honors inputs.branch and falls back to github.ref_name.

Also added persist-credentials: false so the token isn't written to .git/config after checkout — no subsequent step reuses it.

Diff

       - name: Checkout PR branch
         uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.branch || github.head_ref }}
+          # Use the PR head SHA, not github.head_ref. For fork PRs, the
+          # branch NAME lives on the head repo and refs/heads/<name>
+          # is unreachable from the base repo's GITHUB_TOKEN; head.sha
+          # resolves via refs/pull/<N>/head which IS accessible, and
+          # works for same-repo PRs too. workflow_dispatch falls back
+          # to the user-supplied input or the dispatch's ref name.
+          ref: >-
+            ${{
+              inputs.branch
+              || (github.event_name == 'pull_request' && github.event.pull_request.head.sha)
+              || github.ref_name
+            }}
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
+          # Don't persist the token to .git/config; no subsequent
+          # step reuses it.
+          persist-credentials: false

Verification

After merge, re-running the validate job on #486 should:

• Checkout succeed (no more "branch not found")
• Run pnpm check, pnpm test, pnpm build against the PR head code

Refs: #486