fix: review PR head in reused workspace (stale pr-review branch)

[AbirAbbas]

Summary

pr-af reuses a persistent /workspaces/<repo> clone across reviews. _checkout_pr_branch fetched the PR head directly into the local pr-review branch:

git fetch --depth 1 origin pull/<N>/head:pr-review
git checkout pr-review

When the workspace is reused, the previous review leaves pr-review checked out, and git refuses to fetch into the currently checked-out branch (refusing to fetch into branch '...' checked out at ...). That failure was swallowed (capture_output=True, no return-code check), so:

• every PR after the first in a container's lifetime was reviewed against the first PR's working tree;
• the anatomy phase saw the diff not matching the tree and returned zero findings → github-buddy silently "passed" PRs without actually reviewing them.

On Railway, /workspaces is ephemeral (no volume attached), so the stale branch only resets on redeploy — meaning in steady state most PRs were getting rubber-stamped.

Fix

• Fetch the PR head to FETCH_HEAD (always allowed, even with pr-review checked out), then point the branch at it with git checkout -B pr-review FETCH_HEAD.
• Both git calls now check their return code and raise, so a failed fetch/checkout surfaces loudly instead of silently reviewing a stale tree.

Tests

New tests/test_resolve_repo.py — real-git behavior tests (no mocking of internals):

• fresh workspace → working tree reflects the PR head
• reused workspace → working tree updates to the new PR head, not the prior PR's tree (regression for the bug; verified failing on the pre-fix code)
• unfetchable PR ref → raises instead of leaving a stale tree

Validation

• ruff check src/ scripts/ — passes (CI lint gate)
• New tests pass; full suite green except one pre-existing, unrelated flaky timeout test (test_create_request_fails_fast_when_hax_wedges), which fails identically on main.

🤖 Generated with Claude Code