fix: checkout correct repo/ref in CI for fork PRs (#2560)

## Summary - Add `repository` and `ref` parameters to the checkout step in CI workflow so it correctly checks out the fork's branch when running on pull requests from external contributors - Update package-lock.json with dependency resolution changes ## Test plan - Verify CI passes on this PR - Test by opening a PR from a fork and confirming CI checks out the correct branch 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- <a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2560" target="_blank"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1"> <img src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1" alt="Open with Devin"> </picture> </a>   --- ## Summary by cubic Fix CI checkout for forked pull requests. The workflow now checks out the PR’s head repo and branch so jobs run against the contributor’s code. - **Bug Fixes** - Pass repository and ref to actions/checkout, using PR head repo/ref when available with safe fallbacks. - **Dependencies** - Regenerated package-lock.json to reflect updated resolutions; no version changes. <sup>Written for commit 37839729e6e42b41dbc2c71a84dddcd50f3103da. Summary will update on new commits.</sup>  Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

fix: checkout correct repo/ref in CI for fork PRs (#2560)
dffbf1a9 · Will Chen · GitHub · bdb3de95 · dffbf1a9 · dffbf1a9
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -243,6 +243,9 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
+        with:
+          repository: ${{ needs.check-changes.outputs.pr_head_repo || github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ needs.check-changes.outputs.pr_head_ref || github.event.pull_request.head.ref || '' }}
      - name: Initialize environment
        uses: actions/setup-node@v4
        with:

--- a/package-lock.json
+++ b/package-lock.json