Fix check-gh-aw-lockfiles to use PR files API instead of git diff

A 3-dot `git diff base.sha...HEAD` over-includes upstream changes that
entered the PR branch via merges from main, which falsely triggers the
gh-aw compile and fails the lockfile check on PRs that did not modify
any gh-aw inputs.

Use the GitHub PR files API instead, which returns the canonical list
of files actually changed by the PR.

Author: trask

.github/workflows/build-common.yml

@@ -188,16 +188,23 @@ jobs:
       - name: Determine workflows to compile
         id: workflows
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           set -euo pipefail
 
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            # Use the GitHub API to get the actual list of files changed in the
+            # PR. A `git diff base.sha...HEAD` would over-include changes that
+            # entered the branch via merges from main, which can falsely trigger
+            # a compile when the PR did not actually modify any gh-aw inputs.
             mapfile -t changed_files < <(
-              git diff --name-only "${{ github.event.pull_request.base.sha }}"...HEAD -- \
-                ".github/workflows/*.md" \
-                ".github/workflows/*.lock.yml" \
-                ".github/agents/**" \
-                ".github/aw/**"
+              gh api --paginate \
+                "repos/${{ github.repository }}/pulls/${PR_NUMBER}/files" \
+                --jq '.[].filename' \
+                | grep -E '^\.github/(workflows/.*\.(md|lock\.yml)|agents/|aw/)' \
+                || true
             )
           else
             mapfile -t changed_files < <(find .github/workflows -maxdepth 1 -name "*.md" | sort)