fix: use PR base SHA for manual Strix targets

[seonghobae]

Summary

• use github.event.inputs.pr_base_sha as the target workspace SHA for manual Strix PR evidence runs
• keep github.sha only as a non-PR workflow_dispatch fallback
• fix the shell self-test fixture so cancelled queue-state stderr is captured before assertion

Why

Manual Strix runs that target another repository must fetch a commit that exists in that target repository. The current workflow used the central .github workflow SHA during workflow_dispatch, causing upload-pack: not our ref when the target repository was aFIPC or another repo.

Validation

• git diff --check
• py -m pytest -q tests/test_pr_governance_audit_contract.py tests/test_opencode_review_normalize_output.py (19 passed)
• bash scripts/ci/test_strix_quick_gate.sh after LF-normalizing CRLF checkout copies of helper shell scripts for local Windows execution (test_strix_quick_gate: PASS)

[seonghobae]

Superseded by #134. The lower-numbered PR now carries the manual target-repository Strix base-SHA fix and the central review-process fallback work, so keeping this duplicate open only adds review/check noise.