safe_outputs checkout fails for pull_request_review events

[strawgate]

Bug

The safe_outputs job checkout step uses ref: ${{ github.base_ref || github.ref_name }}. For pull_request_review events, github.base_ref is empty (GitHub only populates it for pull_request and pull_request_target events), so the expression falls through to github.ref_name which is N/merge — an invalid ref for checkout.

ref: 648/merge
[command]/usr/bin/git fetch ... +refs/heads/648/merge*:refs/remotes/origin/648/merge*
The process '/usr/bin/git' failed with exit code 1

Both push_to_pull_request_branch.cjs and create_pull_request.cjs do their own git fetch + git checkout -B at runtime, so the initial checkout just needs to succeed.

Introduced in

• 🔀 Fix checkout to use base branch instead of github.sha #17249 (b392fc2dd, Feb 20) — added ref: ${{ github.ref_name }} to avoid stale github.sha checkouts
• 🔧 Fix base ref to use github.base_ref || github.ref_name in all workflows #17370 (44a8f694f, Feb 21) — changed to ${{ github.base_ref || github.ref_name }}, which fixes pull_request but not pull_request_review

Affected locations

• compiler_safe_outputs_steps.go:158 — checkout ref
• compiler_safe_outputs_config.go:464,484 — base_branch in handler config
• create_pull_request.go:103 — GH_AW_BASE_BRANCH env var
• create_agent_session.go:115 — GITHUB_AW_AGENT_SESSION_BASE env var

Fix

Add github.event.pull_request.base.ref or github.event.repository.default_branch as a middle fallback:

${{ github.base_ref || github.event.pull_request.base.ref || github.ref_name }}