CI: fix claude-review failing at checkout on every fork PR

[jnasbyupgrade]

Summary

claude-review currently fails for every PR from this fork at the checkout step (actions/checkout's "pwn request" refusal on pull_request_target).

Updated (the original fix here was wrong): allow-unsafe-pr-checkout: true plus keeping the repository:/ref: override that redirects origin to the fork silences the checkout refusal but trades it for a different failure — claude-code-action internally fetches refs/pull/<n>/head from this repo to read the PR's actual content, and that ref doesn't exist on the fork once origin is redirected there. Postgres-Extensions/extension_tools#28 hit and fixed the identical mistake.

The actual fix: remove the checkout override entirely. claude-code-action fetches and reads the PR's content itself; this step only needs to check out the base branch (no ref:/repository:, no allow-unsafe-pr-checkout).

• Renamed the step to "Check out base branch", removed all with: overrides.
• Updated the top-of-file SECURITY note and the trust-gate comment to match (no more manual fork checkout to justify).
• Loud, non-removable warning stays on the trust-gate if: condition — still load-bearing defense-in-depth even though the checkout itself is now safe by construction.

Same pull_request_target self-verification limitation as before: this PR's own claude-review check runs the OLD workflow from master and can't demonstrate the fix on itself. Verification happens on a subsequent PR after this merges.

🤖 Generated with Claude Code

Likely trivial conflict with #15: both touch the same checkout step (#15 bumps @v4 -> @v7; this PR removes the with: block below it). Resolve by keeping @v7 with no with: overrides.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5785201c-1a0c-478d-b7f1-a808f3f26877

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}