ci(ai-validation): address 4 Copilot findings on validate-checkout step

CR pass on #1990/#1991/#1992 raised 4 findings on the new validate-
side actions/checkout step. All valid; folding into one bundle:

1. Fork PR head-ref not found in base repo (#1990, #1991, #1992 each
   raised this). The previous form checked out refs/pull/<n>/merge
   from origin (vyos/vyos-documentation), leaving origin pointed at
   the base repo. claude-code-action then runs
   `git fetch origin <head-ref>` where <head-ref> is e.g.
   `contributor/branch` — which does NOT exist in the base repo for
   fork PRs, so the fetch fails the same way "no .git" failed before.

   Fix: check out the PR HEAD repo (the fork for fork PRs) at the
   head sha. origin now resolves to the head repo where the head
   ref exists, so the action's fetch succeeds. github.token is the
   default GITHUB_TOKEN which can read public forks (the only kind
   of fork that can target vyos/vyos-documentation, since that repo
   is public).

2. Untrusted PR content at workspace root can pre-create reserved
   paths (#1991). The PRs tree at workspace root could in
   principle contain `.reference-db/extracted/...`,
   `pass1-findings.json`, `_changed_md/poisoned.md`, etc., which
   subsequent steps would treat as workflow-generated. The fail-
   closed gate only checks `[ ! -d .reference-db/extracted ]` so a
   PR-placed empty `.reference-db/extracted/` would bypass it.

   Fix: add a "Wipe reserved workspace paths" step right after the
   checkout that `rm -rf`s the workflow-owned paths
   (.reference-db, .vyos-1x, reviewer, reviewer-src, _changed_md)
   and `rm -f`s the workflow-owned files (pass1-findings.json,
   diff-md.patch, changed-*.txt) — every one of these is recreated
   by the trusted producer step immediately following.

3. Checkout runs unconditionally even on skip=true paths (#1991).
   The checkout only needs to run when validate will actually use
   it (skip != true → Pass 2 runs).

   Fix: gate the checkout (and the wipe step) on
   `if: steps.secrets-check.outputs.skip != true`. Move them
   AFTER the secrets-check step in step order so the conditional
   is meaningful.

4. "NO credentials" wording misleading (#1992). actions/checkout
   uses the GITHUB_TOKEN to download the tree — it is not an
   unauthenticated fetch. `persist-credentials: false` only
   suppresses writing the token into the resulting .git/config.

   Fix: rename the step to "Checkout PR HEAD (no persisted
   credentials)" and update the inline comment block to be explicit
   that the token is used for the download but not persisted.

Mirrored byte-identically across rolling/circinus/sagitta + canonical
follow-up after this wave merges.

0 files changed, 0 insertions, 0 deletions