probe: PYTHONSAFEPATH shadowing check (do not merge)

[wezell]

Throwaway PR to verify end-to-end that the pinned action's code runs instead of the checkout's cli/ package after #7/#9/#8.

It changes one always-printed review log line to include [SHADOW-PROBE]. The review run's log is the test: if the marker appears, the checkout's code is still executing; if not, the pinned release runs (expected). Closed immediately after checking.

[github-actions]

dotbot code review:

• Reviewer: meta/muse-spark-1.3 (medium)
• Overall: patch is correct
• New findings this run: 0
• Prior unresolved dotbot findings still relevant: 0
• Active findings total: 0

Single log-string change adding [SHADOW-PROBE] marker has no functional impact; intentional throwaway probe per PR description.

Tip: comment with "/dotbot address comments" to attempt automated fixes for unresolved review threads.

_{reviewed by dotbot · meta/muse-spark-1.3 · medium}

[github-actions]

dotbot code review:

• Reviewer: ~z-ai/glm-latest (medium)
• Overall: patch is correct
• New findings this run: 0
• Prior unresolved dotbot findings still relevant: 0
• Active findings total: 0

The patch only appends '[SHADOW-PROBE]' to a log message string in review_workflow.py, which has no functional, correctness, or security impact.

Tip: comment with "/dotbot address comments" to attempt automated fixes for unresolved review threads.

_{reviewed by dotbot · ~z-ai/glm-latest · medium}

[github-actions]

✅ dotbot review: all reviewer models (meta/muse-spark-1.3, ~z-ai/glm-latest) agree — patch is correct.

_{approved automatically by dotbot}

[wezell]

Probe complete — closing without merging.

Result: the runtime log line is Running dotbot (meta/muse-spark-1.3) to generate review findings... — without the [SHADOW-PROBE] marker this PR adds — so the review executed the pinned v1.3.1 release, not this checkout's cli/ package. (PYTHONSAFEPATH=1 does its job.)

For contrast, before the fix (v1.2.0 pin) a run here printed a message format that only existed in the PR head's code and submitted an approval the pinned revision could not.