## Summary
- Add `repository` and `ref` parameters to the checkout step in CI
workflow so it correctly checks out the fork's branch when running on
pull requests from external contributors
- Update package-lock.json with dependency resolution changes

## Test plan
- Verify CI passes on this PR
- Test by opening a PR from a fork and confirming CI checks out the
correct branch

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2560"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fix CI checkout for forked pull requests. The workflow now checks out
the PR’s head repo and branch so jobs run against the contributor’s
code.

- **Bug Fixes**
- Pass repository and ref to actions/checkout, using PR head repo/ref
when available with safe fallbacks.

- **Dependencies**
- Regenerated package-lock.json to reflect updated resolutions; no
version changes.

<sup>Written for commit 37839729e6e42b41dbc2c71a84dddcd50f3103da.
Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>