Check out Dependabot branch before updating dist

[jeffwidman]

Fix the automatic dist commit added by #741.

On pull request workflows, actions/checkout defaults to GitHub's synthetic merge ref. The build successfully generated and committed the updated bundle for #734, but git push then failed because the checkout was in detached HEAD state:

[detached HEAD 6e87458] [dependabot skip] Update dist/ with build changes
fatal: You are not currently on a branch.

Check out github.event.pull_request.head.ref in the write-enabled job so the generated commit is based on and pushed back to the Dependabot source branch. This matches the checkout used by github/dependabot-action for the same workflow pattern.

Validation:

• workflow YAML parses
• git diff --check
• npm run lint

After this merges, #734 needs to rebase once more to trigger the corrected workflow.

[jeffwidman]

Let's hold off on this, I need to investigate further