Harden PR Description Updater to run from trusted merged-PR context

[Copilot]

The PR Description Updater was failing almost entirely before the agent even started: recent runs landed in action_required with zero jobs, so merged PR descriptions were not being rewritten. The failure pattern matched trigger-time approval/gating on merged PR workflow execution rather than a safe-output or sub-agent runtime problem.

• Trigger and trust model

  • Move the workflow from pull_request to pull_request_target for closed events so merged-PR processing runs from trusted base-repo workflow context.
  • Keep the existing merged-only and signed-branch exclusion gate intact.

• Checkout hardening

  • Add explicit checkout: frontmatter for the trusted base repository/ref:
    • repository: ${{ github.repository }}
    • ref: ${{ github.event.pull_request.base.ref }}
    • fetch-depth: 0
  • This avoids checking out untrusted PR head content under pull_request_target while still giving the workflow the history it needs to summarize landed changes.

• Diff source correctness

  • Generate diff stats, commit logs, and chunked diffs against github.event.pull_request.merge_commit_sha instead of the PR head SHA.
  • Fail fast if merge_commit_sha is missing rather than silently falling back to untrusted head context.

• Generated workflow

  • Recompile pr-description-caveman.lock.yml so the generated workflow reflects the new trigger, checkout policy, and merge-commit-based diffing.

on:
  pull_request_target:
    types: [closed]

checkout:
  repository: ${{ github.repository }}
  ref: ${{ github.event.pull_request.base.ref }}
  fetch-depth: 0

if [ -z "${MERGE_SHA:-}" ]; then
  echo "Missing merge_commit_sha for merged pull_request_target event" >&2
  exit 1
fi

git diff "$BASE_SHA"..."$MERGE_SHA" -- "${EXCLUSIONS[@]}"