fix(ci): claude-mentions fork PR checkout for action v1.0.127

[shane-moore]

Problem, Evidence, and Context (Required)

PR #1042 bumped anthropics/claude-code-action from v1.0.52 to v1.0.127. v1.0.127 added fork-PR fetch logic that assumes origin is the base repo:

// claude-code-action v1.0.127, src/github/operations/branch.ts:175-184
if (prData.isCrossRepository) {
  execGit(["fetch", "origin", `--depth=${fetchDepth}`,
           `pull/${entityNumber}/head:${branchName}`]);
}

claude-mentions.yml predated this: when is_fork == 'true', it pre-pointed origin at the fork via the actions/checkout repository: override. The fork doesn't have refs/pull/N/head (that namespace lives only on the base repo), so the action's fetch fails for every fork PR.

Live failure on PR #1053 (fork PR from shane-moore/anchor, run 26296833180):

PR #1053 is from a fork, fetching via refs/pull/1053/head...
fatal: couldn't find remote ref pull/1053/head
##[error]Action failed with error: Command failed:
  git fetch origin --depth=20 pull/1053/head:feat/ptc-voting-assignments

claude-pr-review.yml already runs the correct pattern (origin = base repo, app-token embedded before checkout; see its own lines 63-68 comment block). This PR brings claude-mentions.yml in line with it.

Related: issue #1043 (separate stale-fork-base diff misattribution bug). Its proposed prompt fix is intentionally kept out of this PR to split by blast radius.

Change Overview (Required)

One file: .github/workflows/claude-mentions.yml.

• Remove the Get PR info for fork support step. Its four outputs were consumed only by the now-removed repository: and ref: overrides; no other steps reference them.
• Move Generate GitHub App token to run before Checkout repository so the token is embedded in origin for the action's PR-ref fetch (matches the ordering and rationale documented in claude-pr-review.yml:63-68).
• Simplify Checkout repository to drop both repository: and ref: overrides. With defaults, origin = sigp/anchor and v1.0.127's git fetch origin pull/N/head:branch succeeds because that ref exists on the base repo.

End state structurally mirrors claude-pr-review.yml:63-82.

Intentionally unchanged:

• All other action version bumps from ci: bump Node20-deprecated actions in stable-loaded workflows (Phase 1 of #1040) #1042.
• claude-pr-review.yml (already correct).
• .github/prompts/review.md (deferred; tied to ci: claude review bot uses fork's stale base branch when computing PR diff #1043).
• Behavior for non-PR issue comments and for same-repo PRs.

Risks, Trade-offs, and Mitigations (Required)

• Blast radius: workflow-only, gated by @claude mention plus org-membership check.
• Same-repo PR path: unchanged in effect. v1.0.127's non-fork branch (isCrossRepository: false) does git fetch origin <branchName> against origin = sigp/anchor, which works in both old and new flavors.
• Non-PR issue comments: actions/checkout defaults to the base repo at the default branch, and setupBranch() skips the PR-fetch path when isPR == false.
• pull_request_review_comment events: GITHUB_REF is refs/pull/N/merge (resolvable from sigp/anchor), then the action does its own pull/N/head fetch. Should work; only fully empirical post-merge.
• App-token scope: the same app-token + checkout ordering is already used by claude-pr-review.yml for fork PR ref fetches, so the GitHub App installation on sigp/anchor already has the required permissions.

Validation (Required)

• Source trace (workflow YAML is not unit-testable):
  • setupBranch() runs before configureGitAuth() in claude-code-action/src/modes/tag/index.ts:66, 83.
  • configureGitAuth() rewrites origin to context.repository.owner/repo (base repo, derived from GITHUB_REPOSITORY env) in src/github/operations/git-config.ts:82.
  • Therefore the workflow's actions/checkout token must already be valid for fork PR ref reads on the base repo at the moment setupBranch() runs. This PR ensures that.
• actionlint passes on the changed file. The remaining SC2086 warnings are pre-existing in untouched shell blocks.
• Post-merge live check (mirrors ci: claude review bot uses fork's stale base branch when computing PR diff #1043's acceptance pattern):
  1. Open a small fork PR (e.g. a comment-only README tweak from a personal fork).
  2. Mention @claude on it.
  3. Confirm the run succeeds (no fatal: couldn't find remote ref pull/N/head).

Rollback

Revert this single commit. No data, config, or operational state involved. Restores the prior (broken) fork-PR behavior but is otherwise neutral.

Blockers / Dependencies

None. Targets stable. issue_comment and pull_request_review_comment triggers load this workflow from the base repo's default branch, so the fix only takes effect once merged to stable (same rule that applied to PRs #830, #844, #845, #974, #997, #1042).

[jnhsigmap]

I verified the stated change vector and this looks fine to me, well caught :)