ci(ai-validation): checkout PR merge ref in validate (claude-code-action needs git workspace)

Smoke verify on PR #1977 (run 25659408343 after github_token fix
landed) reached Pass 2 with valid auth but failed at action setup:

  fatal: could not open `docs/quick-start.md` for reading: No such
  file or directory
  fatal: not a git repository (or any of the parent directories): .git
  Action failed with error: Command failed:
  git fetch origin --depth=20 yuriy/docs-smoke-test-quickstart

The action expects to run inside a git checkout of the PR's repo so
it can `git fetch <head-ref>` and read changed files from the working
directory. Our split-job design checks out vyos-1x, reviewer-src, and
the reviewer-config sparse-checkout into named subdirs but leaves the
workspace root empty (we only have _changed_md/ via artifact download).

Add `actions/checkout` of `refs/pull/<n>/merge` as the FIRST step in
validate. Subsequent steps that create named subdirs (_changed_md/,
.vyos-1x/, reviewer-src/, reviewer/, .reference-db/) coexist with the
docs/scripts/.github content checked out here — no path collisions.

Trust model unchanged:
  * persist-credentials: false (no token in fork-content .git/config)
  * No shell step executes fork code (no pip/npm/make against the
    workspace; Pass 1 runs the trusted reviewer CLI; Pass 2 only uses
    allowlisted Read/Glob/Grep/mcp__github_inline_comment + Bash
    restricted to `gh pr comment|diff|view`)
  * The prepare job continues to provide the canonical bundled
    changed-md set via the pr-input artifact; validate now ALSO has
    the full PR tree available for cross-reference reads

Mirrored byte-identically across rolling/circinus/sagitta + canonical
follow-up.

0 files changed, 0 insertions, 0 deletions