[fix](build) Preserve GitHub API failure diagnostics for code review - #69386

### What problem does this PR solve?

Related PR: apache#69386

The diagnostics helper checkout passes the workflow SHA explicitly. On a merged fork PR's `pull_request_target: closed` event, that trusted SHA can equal `pull_request.merge_commit_sha`; checkout's fork guard rejects it before aggregate status resolution starts. This occurred in [run 39721514326](https://github.com/apache/doris/actions/runs/39721514326/job/119635802685) and [run 39727686843](https://github.com/apache/doris/actions/runs/39727686843/job/119655282682).

Use the trusted default self-checkout for `pull_request_target` events and retain workflow-SHA pinning for other callers. Credentials remain non-persistent and unsafe checkout stays disabled. Closed events still recalculate status for any remaining open PRs sharing the head.

Add event regression tests for both observed merge SHAs, other PR target events, comment/dispatch SHA fallback, and closed-PR aggregation.

### Release note

None

### Check List (For Author)

- Test:
  - [x] Unit Test: `RUN_GH_HTTP_TESTS=1 python3 -m unittest discover -s .github/scripts -p 'test_*.py'` — 264 tests, OK, 19 platform skips. The new event tests fail against the original checkout expression and pass with the fix.
  - [x] Manual test: local replay of the pinned checkout `11d5960a326750d5838078e36cf38b85af677262` input helper and fork guard, 25 assertions. Both original merge cases reject; the fix preserves the trusted event ref/SHA; explicit fork-head checkout still rejects. No real Git checkout or hosted Actions run was performed by this harness.
  - [x] `actionlint .github/workflows/code-review-aggregate-status.yml` and `git diff --check`.
- Behavior changed:
  - [x] Yes. Merged fork PR events can load diagnostics and proceed to status resolution.
- Does this need documentation?
  - [x] No. Internal workflow fix.

### Check List (For Reviewer who merge this PR)

- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label

### What problem does this PR solve?

Related PR: apache#69386

Problem Summary:

When the pending-status API call fails before repository checkout, the failure notification runs outside a Git checkout. Without an explicit repository, `gh pr comment` fails with `fatal: not a git repository`; both the notification and terminal failure step also misidentify the skipped context preparation step as the cause. This occurred in [run 38864234303](https://github.com/apache/doris/actions/runs/38864234303/job/116853272967).

Pass `--repo` explicitly and report failed/cancelled pending-status and checkout steps by name. Distinguish actual context failure/cancellation from skipped or unstarted context in both reporting paths, preserving the existing auth/usage-limit recovery messages and failing exit status.

### Release note

None

### Check List (For Author)

- Test:
  - [x] Unit Test: seven new tests execute the actual workflow shell and env bindings through the diagnostic helper with a fake gh, including a non-Git working directory, early failure/cancellation, skipped context, preserved auth/review reasons, and notification failure.
  - [x] Regression test: new tests fail against the old workflow and pass after the fix. Full script suite: 266 tests, 247 passed and 19 Linux process-supervision tests skipped on macOS; includes real gh against a local HTTP server with fake credentials.
  - [x] Manual test: `git diff --check`; actionlint passes with only its pre-existing unsupported `concurrency.queue` diagnostic filtered. Hosted Actions failure-path validation remains pending.
- Behavior changed:
  - [x] Yes. Early failure notifications no longer depend on a checkout to select the repository, and skipped context is no longer reported as a context preparation failure.
- Does this need documentation?
  - [x] No.

### Check List (For Reviewer who merge this PR)

- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label

### What problem does this PR solve?

Related PR: apache#68872, apache#69386, apache#69469

Problem Summary: Merge current master while preserving the serialized aggregate as the only final code-review status writer. Keep diagnostics for existing paths and add trusted helper installation and failure artifacts to the new manual-pass job. Retain the pending step name so early-failure reporting remains compatible.

### Release note

None

### Check List (For Author)

- Test: 276 script tests OK, 19 platform skips. Durable workflow tests cover authorization, failed reads/writes, PR/head scope, closed heads and single final writer. actionlint with only the existing queue diagnostic filtered; diff check.
- Behavior changed: Manual-pass API failures now retain diagnostics; intended manual acceptance semantics remain unchanged.
- Does this need documentation: No additional user-facing behavior beyond the existing manual-pass guide.

### What problem does this PR solve?

Related PR: #69386

The diagnostics helper checkout passes the workflow SHA explicitly. On a
merged fork PR's `pull_request_target: closed` event, that trusted SHA
can equal `pull_request.merge_commit_sha`; checkout's fork guard rejects
it before aggregate status resolution starts. This occurred in [run
39721514326](https://github.com/apache/doris/actions/runs/39721514326/job/119635802685)
and [run
39727686843](https://github.com/apache/doris/actions/runs/39727686843/job/119655282682).

Use the trusted default self-checkout for `pull_request_target` events
and retain workflow-SHA pinning for other callers. Credentials remain
non-persistent and unsafe checkout stays disabled. Closed events still
recalculate status for any remaining open PRs sharing the head.

Add event regression tests for both observed merge SHAs, other PR target
events, comment/dispatch SHA fallback, and closed-PR aggregation.

)

### What problem does this PR solve?

Related PR: #69386

Problem Summary:

When the pending-status API call fails before repository checkout, the
failure notification runs outside a Git checkout. Without an explicit
repository, `gh pr comment` fails with `fatal: not a git repository`;
both the notification and terminal failure step also misidentify the
skipped context preparation step as the cause. This occurred in [run
38864234303](https://github.com/apache/doris/actions/runs/38864234303/job/116853272967).

Pass `--repo` explicitly and report failed/cancelled pending-status and
checkout steps by name. Distinguish actual context failure/cancellation
from skipped or unstarted context in both reporting paths, preserving
the existing auth/usage-limit recovery messages and failing exit status.