ci(#159): verify exact PR head in ci.yml

Author: marcohost33-maker

.github/workflows/ci.yml

@@ -27,6 +27,9 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           persist-credentials: false
+          # Scientific PR evidence must describe the submitted head itself.
+          # The reusable pilot separately exercises GitHub's synthetic merge ref.
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with: