Fix lint workflow for fork PRs

The lint workflow uses pull_request_target which can't fetch fork
branches by ref name. Switch to checking out by SHA with the fork's
repository, which works for both forks and same-repo PRs.

Skip the auto-push step for fork PRs since we can't push to
external repos.

Author: kenyonj

.github/workflows/lint.yml

@@ -15,7 +15,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6.0.2
         with:
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1.299.0
@@ -38,8 +39,9 @@ jobs:
           fi
 
       - name: Commit and push changes
-        if: env.changes == 'true'
+        if: env.changes == 'true' && github.event.pull_request.head.repo.full_name == github.repository
         run: |
+          git checkout -b ${{ github.event.pull_request.head.ref }}
           git add .
           git commit -m "chore: auto-corrected with RuboCop"
-          git push
+          git push origin ${{ github.event.pull_request.head.ref }}