Support target-only checkout for MultiRepoOps

[seesharprun]

Sidecar workflows often need to operate on a target repository without checking out the repository that hosts the workflow.

Today, checkout is all-or-nothing:

• Adding an additional checkout: entry checks out both the workflow repository and the target repository.
• Setting checkout: false prevents the workflow-repository checkout, but also prevents additional repository checkouts.

Example:

checkout:
  - repository: octo-org/target-repository
    path: target
    github-app:
      client-id: ${{ vars.TARGET_APP_CLIENT_ID }}
      private-key: ${{ secrets.TARGET_APP_PRIVATE_KEY }}
      owner: octo-org
      repositories:
        - target-repository

Desired behavior:

• Check out only octo-org/target-repository.
• Do not check out the originating workflow repository.
• Use the configured GitHub App or token only for the target checkout.
• Allow the sidecar workflow to omit contents: read when it does not otherwise need its own repository content.

An explicit target-only checkout option would enable least-privilege cross-repository workflows.