fix: bind CI evidence to pull request head

tests/test_ci_policy.py

@@ -121,6 +121,14 @@ def test_ci_retains_normalized_test_and_quality_trends_for_ninety_days():
     assert workflow.count("retention-days: 90") >= 2
 
 
+def test_ci_evidence_names_the_pull_request_head_not_the_synthetic_merge_commit():
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    assert "CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}" in workflow
+    assert workflow.count('--head-sha "$CANDIDATE_SHA"') == 2
+    assert '--head-sha "$GITHUB_SHA"' not in workflow
+
+
 def test_ci_runs_checkpoint_portability_contracts_on_windows():
     workflow = WORKFLOW.read_text(encoding="utf-8")
     checkpoint_job = workflow.split("  checkpoint-windows:\n", maxsplit=1)[1].split(