fix(ci): run PR LoC scripts from the default branch, not PR head (#15016)

The PR test LoC job fetched .github/scripts/pr-test-loc-*.mjs from
pull/<n>/head and ran them with node while holding a GITHUB_TOKEN scoped
pull-requests: write, so PR-authored code executed under a write token.

Pin the fetch to the repository default branch. base.sha is not enough:
for stacked PRs it is an unreviewed feature-branch commit any collaborator
can push to, while main is gated by branch protection.

Also pass event data via env instead of shell interpolation, and add
set -euo pipefail so a failed download cannot leave a truncated script.

.github/workflows/pr-test-loc.yml

@@ -23,14 +23,20 @@ jobs:
     timeout-minutes: 2
     steps:
       # Why no checkout: the Files API already has per-file additions/deletions.
+      # Why the default branch and never pull/<n>/head: this job holds a write-scoped
+      # GITHUB_TOKEN, so it may only execute reviewed code. A PR that edits these
+      # scripts takes effect once merged.
       - name: Count test vs non-test LoC
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          TRUSTED_REF: ${{ github.event.repository.default_branch }}
         run: |
+          set -euo pipefail
           for script in pr-test-loc-table.mjs pr-test-loc-summary.mjs; do
-            gh api "repos/${GITHUB_REPOSITORY}/contents/.github/scripts/${script}?ref=pull/${{ github.event.pull_request.number }}/head" \
+            gh api "repos/${GITHUB_REPOSITORY}/contents/.github/scripts/${script}?ref=${TRUSTED_REF}" \
               --jq .content | base64 --decode > "$RUNNER_TEMP/${script}"
           done
-          node "$RUNNER_TEMP/pr-test-loc-summary.mjs" --update-pr "${{ github.event.pull_request.number }}"
+          node "$RUNNER_TEMP/pr-test-loc-summary.mjs" --update-pr "$PR_NUMBER"