ci: bind the no-mistakes attestation to the current PR head

[kunchenguid]

What Changed

The Require no-mistakes gate parsed the no-mistakes-pipeline-attestation:v1 comment and required review/test/document = completed, but it only printed the attestation's head_sha - it never compared it to the PR's current head. A commit pushed directly after a no-mistakes run therefore passed the gate on a stale attestation.

This ports lavish-axi main's head-binding (PR #271) verbatim:

• PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} added to the gate step's env:.
• After the attestation payload parses, the gate extracts head_sha and fails with an ::error:: saying the attestation is STALE for the current head (a commit was pushed after the no-mistakes run; re-run git push no-mistakes to refresh it) unless it equals $PR_HEAD_SHA. Absent on either side fails closed too.
• Everything else is preserved: this repo's triggers, paths-ignore, bot exemptions, job name, and the rest of the script. The gate script is now byte-identical to lavish-axi's; the only file-level difference remains this repo's paths-ignore list (no plugin.json).

This is the attestation contract: a synchronize event whose PR body was NOT rewritten by no-mistakes going red is the intended behavior, not a false positive.

Tests

test/workflows/no-mistakes-gate.test.ts (which extracts and executes the workflow's exact inline run: block) gains four head-binding cases, mirroring lavish's:

• accepts an attestation whose head_sha is the PR's current head
• rejects an attestation whose head_sha is not the current head (asserts the STALE error, the re-run hint, and both shas in the output)
• fails closed when the attestation carries no head_sha at all
• fails closed when the PR head sha is unavailable

runGate and attestation now take an optional head sha, defaulting to the existing HEAD_SHA constant, so every pre-existing case is unchanged.

Transcript

$ npx vitest run test/workflows/no-mistakes-gate.test.ts
 ✓ test/workflows/no-mistakes-gate.test.ts (21 tests) 418ms
 Test Files  1 passed (1)
      Tests  21 passed (21)

$ pnpm build
$ tsc

$ pnpm lint
$ eslint .

$ pnpm test
 Test Files  22 passed (22)
      Tests  451 passed (451)

$ pnpm run build:skill -- --check
skills/tasks-axi/SKILL.md is up to date.

Note

This is a direct PR for internal CI tooling, raised without the no-mistakes pipeline, so the advisory Require no-mistakes check will fail on it (no signature) - expected and non-blocking. Build/test/guard checks are the real signal.