fix: fetch native gate comparison revisions

[kazukinakai]

Summary

• fetch the exact base and head SHAs while the target repository credential is still active
• fail closed when either event SHA is invalid
• pin the organization caller and implementation source to the reviewed fix commit

Production evidence

The latest agiletec canary failed because the private partial clone could not resolve the PR base after the implementation checkout changed credentials.

Verification

• python3 -m unittest discover -s tests (34 passed)
• shell and Node syntax checks
• actionlint v1.7.7
• git diff --check