Constrain CurseForge test result publishing to the exact repository and commit

[Exohayvan]

Summary

When local PR lookup fails, curseforge_testing.py performs a global GitHub search by branch name and mutates the first matching pull request without requiring the expected repository or head commit.

Evidence

• common/scripts/curseforge_testing.py:1191-1207 runs gh search prs --head globally and accepts pull_requests[0].
• The selected nameWithOwner is then used for label creation, PR edits, and comments at lines 1234-1287.
• The global result is not checked against the local remote owner/repository or the branch's resolved head SHA.
• The existing unit test currently codifies cross-repository mutation behavior.

Impact

A common branch name can cause private local test details and labels to be posted to an unrelated repository where the authenticated user has write access.

Reproduction / verification

• Mock two repositories with open PRs sharing the same branch name.
• Verify publishing is refused unless repository identity and headRefOid exactly match the configured local target.

Proposed direction

Remove the unrestricted global fallback. Require an explicit owner/repository allowlist and exact head SHA agreement before any GitHub mutation.

Acceptance criteria

• PR updates are limited to the configured Dissolver Enhanced repository.
• The PR head SHA must match the tested branch SHA.
• Ambiguous or missing matches fail closed without labels or comments.
• Unit tests cover same-name branches across repositories.

Audit provenance

Candidate #6 from the read-only repository audit performed on 2026-07-20. This is separate from existing issues #3, #4, #25, and #27 unless explicitly linked later.