ci(ai-validation): pin validate to prepare merge_sha + fix 2 stray escapes

CR/Copilot pass on the merge-ref + retarget-origin revision raised:

1. (CR on #1991, line 278, Major) Re-resolving refs/pull/<n>/merge
   in validate is racy. GitHub may advance the merge ref between
   prepare and validate (rapid pushes), so Pass 1 (artifact from
   prepare) and Pass 2 (validate workspace) can see different
   revisions. concurrency.cancel-in-progress narrows the window but
   does not make the ref immutable.

   Fix: prepare outputs its post-checkout `git rev-parse HEAD` as
   `merge_sha`, validate checks out THAT exact sha. Both jobs now
   operate on the same revision regardless of subsequent pushes.

2. (Copilot on #1991, two findings on line 294) The merge-ref +
   retarget commit introduced two NEW stray heredoc escapes:
   `PR"'sclaude-code-action'"s`. Same class of error
   as the previous-fix-cycle: shell heredoc escape sequences
   survived verbatim into YAML.

   Fix: replace with plain `PRs` / `claude-code-actions` in the
   inline comment block and step name.

3. (Copilot on #1990/#1991, "PR title/description says HEAD repo +
   head.sha") Metadata cleanup tracked separately — PR titles +
   bodies updated to describe the merge-ref + retarget-origin
   approach (no workflow file change for that part).

Mirrored byte-identically across the 3 open wave-5 PRs (#1990
rolling, #1991 circinus, #1993 sagitta follow-up). Canonical sync
once these merge.

0 files changed, 0 insertions, 0 deletions