Add formal RS-05a checkout gate coverage - #52103

RS-05a requires workflow_dispatch runs with aw_context.item_type == "pull_request" to gate PR checkout on repository scope, actor trust, parse resilience, ref isolation, and a valid PR number. Existing SG formal tests covered SG-01..SG-07 but did not dedicatedly formalize this runtime checkout path.

• Formal RS-05a test suite

  • Adds pkg/workflow/security_architecture_rs05a_formal_test.go.
  • Exercises the existing JS checkout implementation from Go via a small Node bridge.
  • Covers all requested RS-05a predicates: all-pass conjunction, repo mismatch/absence, actor trust, malformed JSON, ref isolation, shell-safe exec, missing/zero item_number, and non-PR bypass.

• Runtime behavior asserted

  • Checkout proceeds only when all applicable gates pass.
  • Cross-repo aw_context.repo skips checkout with a warning.
  • Forked runtime repos and insufficient actor permissions block checkout.
  • Bot/app actors satisfy the actor trust gate.
  • PR refs are fetched only through array-based git fetch origin +refs/pull/<N>/head:....

func TestFormalRS05a_RefIsolationUsesPullHeadRef(t *testing.T) {
    result := runRS05aBridge(t, rs05aDefaultBridgeScenario(t, map[string]any{
        "item_type":   "pull_request",
        "item_number": 456,
        "repo":        "test-owner/test-repo",
    }))

    assertRS05aCheckoutSucceeded(t, result)
    assertRS05aFetchedPullHeadRef(t, result, 456)
}

• Fixes [formal-spec] security-architecture-spec-summary.md — Formal model & test suite — 2026-08-11 #52102