fix(code-review): use stable GitHub PR checkout refs

[alex-alecu]

Summary

• Use GitHub's stable refs/pull/<number>/head ref for code-review checkouts on both same-repo and fork PRs.
• Derive the same pull ref during review payload preparation so existing failed reviews with plain head_ref values can retrigger after source branches are deleted.
• Add regression coverage for checkout-ref resolution and payload preparation.

Verification

N/A - no manual UI path; backend checkout-ref selection only.

Visual Changes

N/A

Reviewer Notes

Full pnpm typecheck is currently blocked by unrelated existing kilo-chat module/type errors under apps/web/src/app/(app)/claw/kilo-chat/* in this checkout. The initial push was blocked by repo-wide pre-push lint/typecheck failures in unrelated services/kilo-chat and services/kilo-ops files; this branch was pushed with explicit approval to bypass that hook.

[kilo-code-bot]

WARNING: Follow-up reviews can run against a stale checkout

upstreamBranch is now the synthetic refs/pull/<number>/head ref. The cloud-agent checkout path fetches that ref into a local branch without configuring an upstream, while v2 incremental reviews reuse previousCloudAgentSessionId and only send a follow-up message. On a later push, the incremental prompt's git pull cannot update this branch, so the agent can read files from the previous commit while reviewing the current PR diff. Please make the follow-up path fetch/checkout this pull ref again, or pin the checkout to head_sha, before starting the review.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/code-reviews/triggers/prepare-review-payload.ts	415	Follow-up v2 reviews can reuse a previous checkout of refs/pull/<number>/head without refetching the updated pull ref.

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
N/A	N/A	N/A

Files Reviewed (4 files)

• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.test.ts - 0 issues
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.ts - 1 issue
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-checkout-ref.ts - 0 issues
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-handler.test.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by gpt-5.5-2026-04-23 · 1,928,785 tokens}

[alex-alecu]

Manual test passed.

Tested:

• Replayed a signed GitHub pull_request.opened webhook for PR fix(code-review): use stable GitHub PR checkout refs #2852 against the local review flow, with pull_request.head.ref set to a branch name that should not be used.
• Dispatched the created code review through the local code-review worker and cloud-agent-next session preparation/execution path.

Verified:

• The review row persisted head_ref = refs/pull/2852/head while retaining the PR head SHA.
• prepareReviewPayload sent sessionInput.upstreamBranch = refs/pull/2852/head.
• cloud-agent-next fetched and checked out refs/pull/2852/head, created fresh session IDs, and the review reached completed.