fix(ci): skip stale auto-fix runs and guard publication

[Abhigyan-Shekhar]

Fixes #1788.

When CI for source commit H fails after the PR has advanced to N, auto-fix currently checks out N and attempts to repair H's failure. This change pins editing to H, skips stale runs, and refuses to publish a fix if the branch changes while Claude works.

The workflow resolves the PR from run metadata, falling back to a single open PR for the recorded branch when GitHub returns an empty pull_requests list (observed on recent same-repository CI runs). It checks the live PR against the run's immutable head_sha before editing and publication. Linked PR head metadata is never used as the recorded source SHA.

Claude receives a read-only GitHub token. A separate publishing job applies its patch to H and pushes with an explicit --force-with-lease=refs/heads/<branch>:H, so Claude cannot bypass the revision guard by pushing directly. Branch movement, including a race during push, skips publication; unrelated push failures still fail the job. Workflow helpers come from the immutable workflow-run default-branch SHA.

PR CI still tests a synthetic merge commit. The prompt distinguishes that from H and directs Claude to the failed logs for merge-specific failures.

Validation: 25 Node regression tests pass, including real local Git publication races and empty PR-metadata lookup; Biome, actionlint (without ShellCheck), and git diff --check pass. The tests run in regular CI. Only the auto-fix workflow, its helper/tests, and the test invocation are changed.

Operational limitation: the publisher uses GITHUB_TOKEN. Under GitHub's current rules, resulting PR CI requires a repository writer to approve the workflow runs; it is not an unattended CI retrigger. Preserving unattended retriggers would require an appropriate publishing App/PAT credential. No new credential setup is included in this fix.

The secret-backed Claude workflow has not been executed live. workflow_run changes take effect after merge to the default branch.