ci(merge-ready): trim comment to one line

The "Check out scripts" step had no `ref:`, so on the `pull_request`
(automerge) event it checked out `refs/pull/N/merge` and on `check_suite`
the suite head SHA -- i.e. the PR's own copy of
`.github/scripts/merge-ready/required.sh` and `evaluate-checks.sh`.

`required.sh` is a generated file replaced wholesale on each sync, so a PR
branched before E2E was added to REQUIRED carried a stale list: labeling it
`automerge` evaluated the gate from the PR's old script and merged it
without E2E required. It is also a privilege escalation -- a same-repo PR
could edit its own gate scripts and self-merge under the job's
contents:write + auto-merge permissions.

Pin the checkout to `ref: main` so Merge Ready always evaluates with main's
gate logic regardless of trigger, matching fork-e2e-mirror.yml's
"trusted; never the PR head" pattern.

Co-authored-by: Isaac

.github/workflows/merge-ready.yml

@@ -106,6 +106,7 @@ jobs:
       - name: Check out scripts
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          ref: main             # trusted gate scripts; never the PR head
           sparse-checkout: .github/scripts/merge-ready
           persist-credentials: false