Verify the PR's checkout, not the bootstrap context

We check the repository, branch, and head before running checkout-bound verification. If the checkout cannot be verified, we explain the skip rather than use another tree or an earlier test command. Test repairs on this path now commit and push the same PR branch before we verify it again. This tightens verification for the existing agent-owned rollout; it does not expand access or enable the rollout for more users.