Fix GH_HOST mismatch and false fork detection on issue_comment events

[Copilot]

Two bugs cause gh pr checkout to fail when a workflow is triggered by an issue_comment event on a non-fork PR in a public GitHub repo.

False "Fork PR detected" warning

For issue_comment events, the PR object is constructed with only {number, state} — no head/base data. detectForkPR treated a missing head identically to a deleted fork's null head.repo, producing a spurious isFork: true.

Before:

if (!pullRequest.head?.repo) {  // true when head is absent entirely
  isFork = true;
  reason = "head repository deleted (was likely a fork)";
}

After:

if (!pullRequest.head) {
  isFork = false;               // can't determine — not a fork signal
  reason = "head information not available";
} else if (!pullRequest.head.repo) {
  isFork = true;                // head exists but repo null → deleted fork
  reason = "head repository deleted (was likely a fork)";
}

gh pr checkout fails when GH_HOST is set to a mismatched host

If GH_HOST is set to a GHE hostname but git remotes point to github.com, gh errors:

none of the git remotes configured for this repository correspond to the GH_HOST environment variable

Adds buildGHExecEnv() which derives the correct host from GITHUB_SERVER_URL and passes it to gh pr checkout:

• github.com → deletes GH_HOST from the exec env (lets gh default)
• GHE hostname → sets GH_HOST to match the server URL

buildGHExecEnv is exported for direct unit testing.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw/contents/.github%2Fworkflows%2Faudit-workflows.md
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node /opt/hostedtoolcache/node/24.14.0/x64/bin/node --experimental-import-meta-resolve --require /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs --conditions node --conditions development /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/dist/workers/forks.js (http block)
• invalid.example.invalid
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git conf�� user.name lure tions/setup/js/node_modules/.bin/git -M main /usr/sbin/git git init�� --bare --initial-branch=main k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/git '/tmp/bare-incregit '/tmp/bare-increadd cal/bin/git git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[lpcox]

Addressed in #24221