fix: use commit SHA for autofix checkout to survive deleted PR branches

[Copilot]

The Auto-fix (lint / format) job in codeql.yml hard-fails when the PR branch is deleted (e.g. auto-deleted after merge) before actions/checkout runs — it tries to resolve the branch name, which no longer exists.

Changes

• Checkout by SHA, not branch name — added PR_HEAD_SHA env var to the "Determine checkout ref" step; for pull_request events ref now outputs the commit SHA. Commit objects are immutable and persist after branch deletion.
• Separate push_ref output — branch name is preserved in a new push_ref output used exclusively by the push step, so the autofix commit still lands on the correct branch when it exists.
• Branch existence guard before push — git ls-remote --exit-code checks the remote ref before pushing; if the branch was deleted between checkout and push, the step skips with a clear message instead of erroring.
• Regression test — test_codeql_autofix_uses_sha_for_checkout_and_branch_for_push added to test_codeql_workflow_paths_ignore.py to pin the contract.

# Before — fails if branch deleted before checkout
echo "ref=$PR_HEAD_REF"

# After — commit SHA always resolvable; branch name kept for push only
echo "ref=$PR_HEAD_SHA"
echo "push_ref=$PR_HEAD_REF"

# Push step — skip gracefully if branch was auto-deleted
if git ls-remote --exit-code origin "refs/heads/$PUSH_REF" >/dev/null 2>&1; then
  git push origin "HEAD:$PUSH_REF"
else
  echo "PR branch '$PUSH_REF' no longer exists on the remote; skipping push."
fi

[Copilot]

@Bryan-Roe Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository and had to close this PR. The error I am seeing is:

no `copilot-setup-steps` job found in your `copilot-setup-steps.yml` workflow file. Please ensure you have a single job named `copilot-setup-steps`. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please unassign and then reassign issue #0 to me and I'll retry. Thanks!

[sourcery-ai]

Sorry @Bryan-Roe, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.