ci: check out the code under test, not always the CI branch

[saqibmanan]

A pull request's checks currently test CI, not the pull request. That has now caused three distinct failures in a single day.

The problem

Every job pins both:

repository: CivicDataLab/CivicDataSpace-test
ref: CI

Pinning repository: is necessary — this workflow is called from DataSpaceBackend and DataSpaceFrontend, and without it a checkout there would fetch the caller's code rather than this suite. Pinning ref: was not.

What it cost

	What happened
#24	Added tests that never executed on their own PR. Green, merged — then failed consumer-smoke on the next deploy in a different repo, which rolled the backend back and skipped the frontend's promote-dev.
#20	Checks reported on CI, so the merge being proposed was never tested. Merged on a red check whose cause went unexamined.
#26	The fix for the above could not go green — its checks ran the broken code it was deleting. Needed an override to merge.

None of these were bad luck. A PR whose checks do not test the PR is reporting on something else, and its green means nothing.

The change

ref: >-
  ${{ github.repository == 'CivicDataLab/CivicDataSpace-test'
      && (github.event.pull_request.head.sha || github.sha)
      || 'CI' }}

• In this repo — check out whatever triggered the run: the PR head for pull_request, the pushed commit otherwise.
• Called from another repo — github.repository is the caller, so CI is still used. The reusable path is unchanged.

Applied to all three jobs.

Self-testing

This PR is its own test case. pull_request events use the workflow file from the PR head, so the checks on this PR should exercise this change — if they run against this branch rather than CI, it works.