pr-pipeline: treat a run head as forged when no caller or event head was gated #8945

Problem

In .github/workflows/pr-run-activity-read.yml, the report job's "Choose the head the check is posted on" step counts the PR head it read from the API as the gated head whenever neither the caller's head-sha input nor the event names one. That head may have moved during the run. A run job that names the moved head then reads as not forged, and its check is posted on that head.

No current caller can reach this: pr-unblock.yml always passes head-sha, and issue mode skips the report job.

Proposed fix

When there is no caller or event head, treat any non-empty run head as forged: drop the API-head fallback from the match set and keep the API head only as a posting target. Update the report-job test case that expects a run head matching the API head alone to post success, so it expects a forged result instead.

Context

Found in the security review of #8902 (5b), finding 3, and left as a follow-up.

🤖 Generated with Claude Code