Make signature CI pull-request aware

[robobryce]

Summary

• select the commits belonging to an open pull request instead of comparing every branch to main
• support fork PRs and upstream pull-request/<number> mirror branches
• use the push payload for non-PR branches and the merge-group base/head range for merge queues
• fail closed on truncated push payloads, PR-discovery failures, and commit-verification API failures
• make signature-failure remediation fetch the actual PR base branch
• prevent fork workflow runs from trying to comment on an upstream PR, and derive mirror PR numbers only from the trusted branch name

Root cause

PRs based on event/2026-07-cscs-summer-school inherited commits that are not on main. The old origin/main..HEAD comparison treated those inherited commits as PR commits, so #227 checked 40 commits and failed on 21 unsigned event-branch commits even though its own commit was validly signed.

Validation

• simulated fork PR, pull-request/<number> mirror, new branch, non-PR push, deleted branch, truncated payload, and API-failure paths
• verified Tune PyHPC power iteration for H100 #227 compares c23ec73...2f3250c as exactly one commit
• simulated cross-repository comment suppression and base-aware remediation output
• yamllint on both workflows
• JavaScript syntax checks for both github-script blocks
• pre-commit and pre-push hooks
• git diff --check

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

👋 Thank you for your contribution!

This pull request is from a forked repository so GitHub Actions will not be able to run CI. A maintainer will review your changes shortly and manually trigger the CI.

@maintainers Please review this PR when you have a chance and follow the instructions in the CONTRIBUTING.md file to trigger the CI.