ci: Snapshot API against the PR head, not the merge ref

actions/checkout defaults to the pull_request merge ref (PR + target
branch), so the matrix job was running ApiApprovalTests against a tree
that differed from the PR head. The accept job then committed those
.verified.txt files onto the PR head — which doesn't contain target's
changes — guaranteeing the next run would fail again.

Pin the matrix checkout to pull_request.head.sha so both jobs operate
on the same tree.

Author: jamescrosswell

.github/workflows/verify-api.yml

@@ -35,9 +35,14 @@ jobs:
             slnf: Sentry-CI-Build-Windows.slnf
 
     steps:
+      # Check out the PR head sha, not the GitHub-synthesized pull_request merge
+      # ref. Otherwise we'd snapshot the API surface of (PR + main) and commit
+      # those .verified.txt files back to the PR head, which doesn't contain
+      # main's changes — the next run would fail again.
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ github.event.pull_request.head.sha }}
           submodules: recursive
 
       - name: Remove unused applications