feat(github): fetch trusted PR snapshots and effective policy

[back1ash]

Summary

Fetch immutable pull-request content without executing fork code and derive policy from the trusted base repository.

Scope

• Fetch base, head, and test-merge content by immutable commit identity.
• Read trusted configuration from the base and analyze the candidate specification closure from the test merge.
• Prevent head changes from weakening paths, rule-pack identity, or gate threshold.
• Create content-addressed worker inputs without forwarding installation tokens.
• Handle deleted, unreadable, stale, and same-head-SHA pull requests explicitly.

Acceptance criteria

• Every scan is bound to repository, PR, base, head, test-merge, input, and policy identities.
• No contributor-controlled code is executed.
• Fork content cannot access credentials, policy, or report destinations.
• Base updates invalidate stale success and create the correct new logical run.
• The implementation reproduces the accepted Issue spike(github): validate public fork PR Checks and trust isolation #7 matrix behavior.

Dependencies

• spike(github): validate public fork PR Checks and trust isolation #7
• docs(security): define the initial threat model #8
• feat(github): verify webhooks and persist idempotent scan requests #30
• feat(core): define the P0 scan configuration contract #19
• feat(core): implement repository-confined input closure and manifest #20

Priority gate and claiming

Keep status:blocked until every open priority:p1 issue is closed,
the Phase 0 hosted-product decision is proceed, and every explicit
dependency above is closed. Only then replace it with status:ready
and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Worker execution, Check Run publication, or private repository access.
• Trusting workflow files from the pull-request head.