claude-code-review.yml: stop checking out fork PR head, restore base-branch checkout

[jnasbyupgrade]

anthropics/claude-code-action's internal setupBranch() logic fetches a fork PR's branch itself via git fetch origin pull/<N>/head:<branch>, which requires origin to be the base repo (only the base repo carries refs/pull/<N>/head). Checking out the fork directly first, as this workflow's "Check out PR head" step did, points origin at the fork instead, which has no such ref -- breaking that fetch with "couldn't find remote ref pull//head" and silently failing the review on every fork PR (confirmed on #54, reproduced identically on rerun).

This exact failure mode was already fixed once, in c38cf2a ("never check out fork PR head..."), which switched to a plain base-branch checkout and let the action fetch the PR itself -- the safe, intended pattern per the action's own examples. db6ae56 ("add missing --comment flag") bundled in an accidental revert of that fix alongside its actual fix, reintroducing the fork checkout and the allow-unsafe-pr-checkout escape hatch. This restores the base-branch checkout on top of everything db6ae56 and later commits actually intended to change.

Per .github/workflows/CLAUDE.md, pull_request_target always runs the workflow file from master, so this PR's own claude-review check cannot prove the fix -- verification happens on the next PR after this merges.

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" on the changed workflow file
• After merge, confirm the next fork PR's claude-review check succeeds and posts a real review comment (this PR's own check will still run master's pre-fix version, per the note above)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 68aa856a-3667-4610-8afa-2cde2d56398b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}