fix(ci): make clang-format check merge-race safe

[KemengHuang]

Summary

• compare clang-format inputs using the immutable pull-request base/head SHAs
• remove the moving shallow fetch that can lose the merge base when a PR merges while the job is running
• add a repository contract for the workflow invariant

Validation

• Repository Contracts: 32/32
• local clang-format-18 check for the merged source change: passed