Check the PR base with gh api, not an unauthenticated ls-remote

This step runs before actions/checkout has configured git credentials, so
ls-remote over https has no auth at all. It happens to work here because
this repo is public, but it fails with exit 128 against a private one
(verified against accessibility-checker-pro with credential helpers
disabled) - and the sibling repos share this workflow's shape.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019LoLgW7oFjBPxGea9kiZJ2

Author: pattonwebz

.github/workflows/make-pot.yml

@@ -93,13 +93,18 @@ jobs:
 
       # Fail here rather than many minutes later inside create-pull-request,
       # which reports a missing base as an opaque 422 from the API.
+      # `gh api` rather than `git ls-remote`: this step runs before
+      # actions/checkout has configured any git credentials, so an
+      # unauthenticated ls-remote cannot see a private repository's branches
+      # and would fail every single run.
       - name: Verify the PR base is a real branch
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BASE: ${{ steps.resolve.outputs.base }}
-          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
-          if [ -z "$(git ls-remote --heads "${REPO_URL}" "refs/heads/${BASE}")" ]; then
+          if ! gh api "repos/${REPO}/branches/${BASE}" --silent 2>/dev/null; then
             echo "::error::'${BASE}' is not a branch in this repository, so a PR cannot target it."
             echo "If you built from a tag or SHA, pass the 'base' input to say which branch the PR should go into."
             exit 1