fix: ensure CI runs on bot-created PRs

[GarthDB]

Problem

CI workflows are not running on bot-created PRs like the Changesets release PR (#9). This is due to GitHub's security restrictions on pull_request_target events.

Solution

• Add job name: CI Tests and Checks for proper status check registration
• Fix checkout: Use github.event.pull_request.head.sha for pull_request_target events
• Maintain security: Only checkout the PR head, not base with elevated permissions

Testing

This should allow CI to run on:

• ✅ Regular PRs (existing functionality)
• ✅ Bot-created PRs (Changesets, Dependabot, etc.)
• ✅ Status checks should appear in branch protection rules

Related

• Fixes CI not running on PR chore: version packages #9 (Changesets release PR)
• Ensures proper status check registration for branch protection

[changeset-bot]

⚠️ No Changeset found

Latest commit: 85297be

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR