ci: check out PR head commits in workflows

[bolinfest]

Why

PR CI should test the exact commit that was pushed to the PR branch. By default, GitHub's pull_request event checks out a synthetic merge commit from refs/pull/<number>/merge, so the tested tree can include an implicit merge with the current base branch instead of matching the pushed head SHA.

Using the PR head SHA makes each check result correspond to a concrete commit the author submitted. This also behaves better for stacked PR workflows, including Sapling stacks and other Git stack tooling: a middle PR's head commit already contains the lower stack changes in its tree, without pulling in commits above it or GitHub's temporary merge ref.

What Changed

• Set every actions/checkout in pull_request workflows under .github/workflows to use github.event.pull_request.head.sha on PR events and github.sha otherwise.
• Updated blob-size-policy to compare github.event.pull_request.base.sha and github.event.pull_request.head.sha, since it no longer checks out GitHub's merge commit where HEAD^1/HEAD^2 represented the PR range.

Verification

• Parsed the edited workflow YAML files with Ruby.
• Checked that every checkout block in the pull_request workflows has the PR-head ref.