ci: build PRs against the pinned DuckDB submodule, not the branch tip

PR CI currently overrides the submodule and checks out the tip of the
matching duckdb/duckdb branch at run time. This makes PR results a
function of the wall clock: a green PR turns red a week later because
upstream changed, even when the PR only touches this repository.

Dropping the override makes PR CI build the commit the submodule
actually pins, so results are reproducible for an identical diff.
Upstream drift is still caught where it has an owner: the duckdblabs
bot's periodic submodule-bump PRs, whose CI now also starts testing
the exact SHA they pin (previously they, too, built the moving branch
tip rather than the commit being pinned).

This matches duckdb-java, where PR CI builds only the vendored
(pinned) engine sources and a separate Vendor workflow advances them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: NickCrews

.github/workflows/on_pr.yml

@@ -37,7 +37,6 @@ jobs:
     with:
       minimal: true
       testsuite: all
-      duckdb-sha: ${{ github.base_ref }}
 
   coverage_test:
     name: Run coverage tests
@@ -46,5 +45,4 @@ jobs:
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }}
     uses: ./.github/workflows/coverage.yml
     with:
-      duckdb_git_ref: ${{ github.base_ref }}
       testsuite: all