ci(ai-validation): rebase onto rolling@HEAD (#1968) — keep SHA pins/DB pin/no-id-token

PR #1968 merged on rolling while this PR was in CR review. It adds:
  * has_md_changes output on prepare + job-level if-gate on validate
    (fixes the empty-_changed_md/ crash on infrastructure-only PRs)
  * fetch base by refs/heads/<ref> + use FETCH_HEAD instead of
    origin/<ref> (fixes the tag-vs-branch ambiguity on vyos/vyos-
    documentation where 'rolling' exists as both a branch and a tag)
  * skip validate on deletion-only Markdown PRs

This commit pulls in rolling@HEAD's ai-validation.yml verbatim,
then re-applies the 4 still-needed fixes raised by CR/Copilot:

  1. SHA-pin actions/checkout@v6 (x4) + actions/upload-artifact@v4 +
     actions/download-artifact@v4 + anthropics/claude-code-action@v1
  2. Pin reference-DB download to tag: ${{ env.REVIEWER_REF }}
     (was latest: true) — aligns DB version with pinned reviewer code
  3. Drop id-token: write from validate job permissions (no OIDC use)

Items already present in rolling@HEAD via PR #1968 (no further action
here):
  * NUL/control-char rejection in changed-*.z (the corrected
    grep -zPq '[\x01-\x1F\x7F]' form, plus the explanatory
    comment block about why NUL is excluded from the rejection class)
  * Job-level if-gate on validate so infrastructure-only PRs skip the
    entire expensive validate chain
  * mkdir _changed_md defensive step in validate

Result: 3 PRs (this one + the circinus/sagitta companions) now share a
single byte-identical workflow file that is also a strict superset of
rolling@HEAD's current file (3 fixes layered on top).

0 files changed, 0 insertions, 0 deletions