fix(ci): compare attribution with PR base

[BenKalsky]

What

• pass the actual pull-request base into the reusable attribution workflow
• fetch and compare against that base instead of hard-coded origin/main
• run the attribution check for CI-workflow changes so this fix validates itself

Why

PR #5 targets upgrade/v0190-issue-carries, but the check compared it with main and scanned 3,067 unrelated carry-history commits, producing a false failure.

Verification

• git diff --check
• PR CI must run check-attribution against this PR's carry base
• after merge, rerun PR fix(codex): require final evidence in oneshot #5 to prove the custom-base case end to end