[sahilmob]

Fork reviews could fetch a moving PR diff after verifying its commit IDs, allowing a concurrent push/reset to change the analyzed content. They could also publish a successful result that said the diff was unavailable.

This change fetches the diff, changed files, and inline comment locations by immutable base/head SHAs; rejects missing-diff results without anchored findings; and checks both the base and head before posting. Comparisons with 300 or more files fail closed because GitHub caps the returned file list. The posting job gains contents:read for the comparison endpoint, while analysis and posting remain on separate runners.

The fork workflow also pins the Codex CLI and Responses API proxy to 0.160.0 and rejects empty or floating version overrides.

Validation:

• 29 regression tests covering the push/reset race, authorization, output validation, posting targets, changed commits, comparison truncation, and version validation.
• actionlint passed for the fork workflow, both consumer templates, sync workflow, and new test workflow.
• Read-only verification against refactor(workspace): bumped to the latest rust version and latest edition. codemod#2403: immutable comparison returned 168 files and the same 376,759-byte diff as the PR endpoint.
• No live Azure-backed review or Linux sandbox penetration test was performed.

Adds a pull-request CI job to run the regression tests without secrets. Follow-up hardening for #2.