ci: unblock fork PRs (SENTRY_CLIENT_ID fallback + fork-safe checkout)

[BYK]

Summary

• Three failures on PR #806 / run 24747631157 traced to fork-PR restrictions:
  1. check-generated checks out github.head_ref from the base repo, but that branch only exists on the fork → git fetch exits 1.
  2. build-binary and build-npm hard-fail because ${{ vars.SENTRY_CLIENT_ID }} isn't reaching fork jobs (likely blocked by the getsentry org's "Send variables to fork PR workflows" policy).
  3. CI Status fails because of (1) and (2).

Fix

• check-generated checkout: condition ref: on whether the app token step succeeded. Same-repo PRs keep the branch-head checkout (so auto-commit can git push regenerated docs back). Fork PRs leave ref empty → actions/checkout defaults to GITHUB_REF (the PR merge SHA, always fetchable from the base repo with github.token).
• build-binary / build-npm env: fall back to a dummy SENTRY_CLIENT_ID when vars.SENTRY_CLIENT_ID is empty. All tests in the repo already tolerate any non-empty value (see test/preload.ts and the "test-client-id" defaults in e2e tests); CI smoke tests are --help only. PR binaries never ship, so runtime OAuth paths aren't exercised.

What doesn't change

• Same-repo PRs and main/release/** pushes still bake the real vars.SENTRY_CLIENT_ID into the binary.
• script/build.ts and script/bundle.ts keep their hard-fail guard — useful dev ergonomic for local builds.
• Security posture: no pull_request_target, no new secret exposure, no org-policy change.

Test plan

• Own-repo CI on this PR must pass (baseline sanity).
• After merge, ask @elucid to rebase fix(dsn): skip non-regular env files during detection #806 to validate the fork path.

[github-actions]

Codecov Results 📊

✅ 138 passed | Total: 138 | Pass Rate: 100% | Execution Time: 0ms

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	—
Failed Tests	—
Skipped Tests	—

✨ No test changes detected

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 1951 uncovered lines.
❌ Project coverage is 95.19%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
- Coverage    95.21%    95.19%    -0.02%
==========================================
  Files          282       282         —
  Lines        40577     40576        -1
  Branches         0         0         —
==========================================
+ Hits         38633     38625        -8
- Misses        1944      1951        +7
- Partials         0         0         —

---

Generated by Codecov Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 343bff7. Configure here.}