fix(workflow): check out PR head branch so fixes push to the PR

[hilram7]

Root cause

The workflow checked out the base branch (dev) rather than the PR head branch. As a result, when the autofix script committed and pushed its changes, they went to dev instead of the PR branch — so renamed files never appeared in the PR diff.

The bot comment was posted regardless of push success (the push step uses continue-on-error: true), which is why the workflow appeared to work while the files weren't actually being renamed in the PR.

Fix

• Changes the checkout ref from pull_request.base.ref to pull_request.head.ref so the bot commits land on the PR branch
• Removes the "Fetch changed files from PR head" step added in fix(md-autofix): fetch PR files before running script #732 — no longer needed since the PR files are already on disk when checking out the head branch

CodeQL: actions/untrusted-checkout/medium will flag this checkout. Dismissed — PRs are restricted to Netwrix org members with SSO; the untrusted-contributor attack vector does not apply. See alert #80 for full justification.