🔀 Fix checkout to use base branch instead of github.sha

[dsyme]

Summary

• Replace implicit github.sha checkout with explicit ref: ${{ github.ref_name }} across all workflow lock files to prevent spurious "workflow file changed" errors
• Update compiler_safe_outputs_steps.go to resolve the checkout ref dynamically — preferring the create-pull-request base branch when set, falling back to github.ref_name
• Add unit tests covering default ref, custom base branch, and release branch scenarios

[Copilot]

Pull request overview

This pull request fixes a critical issue where workflow checkouts were implicitly using github.sha instead of the base branch, which could cause spurious "workflow file changed" errors when an older commit's workflow files differ from the current branch.

Changes:

• Updated checkout logic in compiler_safe_outputs_steps.go to explicitly set ref parameter, preferring CreatePullRequests.BaseBranch when configured, otherwise defaulting to github.ref_name
• Added comprehensive unit tests covering default ref, custom base branch, and release branch scenarios
• Regenerated all 31 workflow lock files to include the explicit ref: ${{ github.ref_name }} parameter in checkout steps

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated no comments.

File	Description
pkg/workflow/compiler_safe_outputs_steps.go	Added logic to determine checkout ref, prioritizing custom base-branch from create-pull-request config, with fallback to github.ref_name
pkg/workflow/compiler_safe_outputs_steps_test.go	Added three test cases validating default ref behavior, custom base-branch, and release branch scenarios
.github/workflows/*.lock.yml (31 files)	Regenerated workflow files with explicit ref: ${{ github.ref_name }} in checkout steps to prevent spurious workflow file changed errors

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.