fix(ci): trailer-verify binds to the PR tip, not any ancestor (#2399)

[forkwright]

Finding

gate-attestation.yml's verify step and hybrid-gate.yml's check-trailer step both looped every PR commit (git log --format=%H origin/base..HEAD → for sha … break on the first Gate-Passed: trailer). So an un-stamped tip could ride an ancestor's trailer: gate-attestation reports a false green on the actually-merged tree; hybrid-gate falsely sets found=true and skips full-gate-build (the real fmt/check/clippy/nextest). This is kanon#2399 — the dual of the false-DONE-GREEN class.

Fix

Bind the trailer check to the PR tip (github.event.pull_request.head.sha), not any ancestor. Step-only change: read the tip commit's own body via env-var indirection and check that.

• head.sha is server-populated + content-addressed (un-spoofable) and is exactly the SHA branch-protection keys pass/fail to — a new push = a new SHA = a fresh unsatisfied requirement.
• It is reachable in the existing fetch-depth: 0 pull_request checkout (it is the second parent of the auto-merge commit), so the checkout is unchanged — which also keeps hybrid-gate's docs_only detection (it needs the base..HEAD history from the same checkout) working.
• Env-var indirection (PR_HEAD_SHA) satisfies the expression-injection rule, matching the sibling PR_AUTHOR/PR_HEAD_REF pattern already in these files.

Unchanged: the 3-way automation waiver (dependabot[bot] / release-please[bot] / startsWith(head_ref, 'release-please--branches--')), the actions/checkout@v7.0.1 pin, fetch-depth: 0, persist-credentials: false, and hybrid-gate's found output routing (never exits 1 → routes to full-gate-build).

Consumers pick this up automatically on @main — no pin bump. kanon's own inline gate-attestation.yml copy carries the same loop and is fixed separately (batched with a kanon train); the release-please--branches--* waiver being an unauthenticated bypass is a distinct security issue (kanon#2628).

Cross-validated (3 lenses): hole closed, no false-RED, actionlint clean.

Refs #2399