chore(cla): point the agreement link at the canonical repository (ENG-2017)

[lucas-koontz]

User story

As an outside contributor being asked to sign a contributor agreement
I want the link to name the repository that actually holds the document
So that what I read cannot be changed by somebody claiming an unused repository name

Why this matters

The URL this workflow passed is an alias. It redirects to the repository that actually holds the agreement, and it serves byte-identical content, md5 1d587ab6722aa5dd0885ed1daad806d7. So nothing a contributor reads changes today.

An alias holds only while nobody occupies the name. Anyone who creates a repository at the old name takes the URL, and the redirect stops. The page this points at is the one a contributor reads immediately before agreeing to it, which makes it a worse place than most to leave that open.

This is the same shape as the other supply-chain finding in this change set. cla-assistant/github-action, referenced by three library repos, is also an alias for a repository under a different name, and the fix there was the same: name the thing that actually serves the content.

The org used two different aliases for one document. anton passed one, cowork and cowork-server passed another, and the ten library repos in this change set passed a mix. All of them resolve to the same file. After this, all thirteen name the same repository.

Acceptance criteria

• The CLA comment links to a URL that resolves directly, with no redirect.
• The document a contributor reads is unchanged, byte for byte.
• Negative: nothing else in the workflow changes. Same triggers, same permissions, same allowlist, same signature ledger.

How to test

1. Open the new URL in a browser and confirm it returns 200 rather than a redirect.
2. Open a pull request from a fork with an account not in the allowlist and confirm the bot comments with the new link.
3. Confirm the signature ledger on the cla branch is untouched.

Notes for the reviewer

The allowlist is gone from this file, and staff now sign like everybody else. Fifteen repositories carried six different hand-maintained copies naming 25 people between them, and 11 of those 25 had already left the org while still being exempt from signing. It now defaults in the reusable and is bots only: dependabot[bot] and mindsdb-release-train[bot], the two that actually open pull requests in this org. A bot cannot post the agreement sentence, so without an exemption its pull request is red forever.

Dropping the line also drops two live defects that rode inside it. bot* compiled to an unanchored new RegExp("bot.*").test(login), so it exempted any login containing "bot", including robotnik and sabotage; anyone could opt out of the CLA by choosing a username. And Stpmax never matched the real login StpMax, because non-wildcard entries use a case-sensitive ===. Needs mindsdb/github-actions#56, which gives the input its default.

The green CLAssistant row on this pull request does not exercise this change. pull_request_target loads the workflow from the base branch, so the check that passed here is the copy this PR replaces, running on mdb-dev. The new job cannot test itself on its own pull request; it is exercised on the first pull request opened after this merges.

One line, and deliberately only one line. The agreement itself is not changing and neither is the ledger. This repo already runs the CLA check on a hosted runner through the shared reusable, which is what the rest of ENG-2017 is bringing the other ten repos up to.

Based off staging, so it reaches main on the next release. pull_request_target evaluates the workflow from the pull request's base branch, so this takes effect for staging-targeting PRs on merge and for main-targeting PRs after the release train carries it across.

Verified locally

Check	What I observed
actionlint on the changed file	Clean, v1.7.12.
The two documents are the same file	curl of both URLs, md5 1d587ab6722aa5dd0885ed1daad806d7 on each, and diff reports no difference.
The new URL resolves directly	HTTP 200. The alias returns 301.
Nothing else moved	The diff is one line.

Ships with

The ENG-2017 change set, which takes the CLA check off the in-cluster runners in
ten library repos and hardens the shared reusable. This repo already called that
reusable, so only the document link changes here.

Anchor: mindsdb/github-actions#55.

Merge order: the anchor first, and that is a requirement rather than a
preference. This wrapper grants actions: read, and until
mindsdb/github-actions#55 merges the reusable still declares actions: write.
A called workflow's permissions are enforced when its file is loaded, so a
callee naming a scope its caller has not granted rejects the whole run as a
startup_failure with zero jobs, and there is no job left to report it. The
run is red, the CLA gate is down, and nothing announces either.

Refs: ENG-2017