Refresh stale pull request bases

[dapi]

What changed

When the uniquely selected remote-tracking base of an open PR is stale, review discovery now fetches only that advertised base branch into the existing tracking ref and revalidates its SHA before starting Codex.

Safety

• Never runs git pull and does not modify the current branch, worktree, real index, or PR.
• Never fetches for explicit --review-base, local-only, ambiguous, or non-PR bases.
• A failed fetch or post-fetch SHA mismatch remains an operational failure.

Routing and validation

• Flow: Feature follow-up within FT-016, which owns review-base discovery and its public contract.
• Validation profile: high-risk; this adds a bounded network/ref mutation at the provider trust boundary.
• go test ./...
• go vet ./...
• make docs-lint
• git diff --check