fix: check out privileged test commits from base repo pull refs

[AaronFeledy]

What does this do?

Fixes the privileged Leia test dispatch failing with Version 6209 must be semver valid! (https://github.com/lando/core/actions/runs/31334820529).

The job checked out the fork repository directly, but forks don't carry upstream tags, so prepare-release-action had no v* tag to derive a dev version from and choked on the raw commit SHA.

Now the job checks out the base repository (tags present) and fetches the reviewed commit via pull/N/head, which lives in the base repo. This also removes the head-repo API lookup and keeps working if the fork is deleted. The security property is unchanged: the job still checks out the exact maintainer-reviewed SHA, validated against the current PR head.

Testing

• actionlint
• simulated the exact sequence against PR Restore Node 24 (and before) behavior as fs.existsSync() now throws deprecation warning #474's head: shallow base clone, git fetch origin pull/474/head, checkout of the fork head SHA, unshallow, git describe resolves v3.26.7

[netlify]

✅ Deploy Preview for lando-core ready!

Name	Link
🔨 Latest commit	60a2170
🔍 Latest deploy log	https://app.netlify.com/projects/lando-core/deploys/6a78e847979a260008470641
😎 Deploy Preview	https://deploy-preview-487--lando-core.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 77 (🔴 down 12 from production) Accessibility: 89 (no change from production) Best Practices: 92 (no change from production) SEO: 90 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.