[ci-scan-feedback] Read ci-fix head.ref via list/get, not search, to close dedup gap

## Triggering signals

- **#131981** — help-wanted `[ci-fix]` PR closed unmerged by `kotlarmilos` (MEMBER) on 2026-08-14 with the comment **"Duplicate https://github.com/dotnet/runtime/pull/131515"**. Both PRs target KBE **#131382** with the same `WindowsShell` fix, and #131515 was already **open** (created 2026-07-29) when #131981 was filed (2026-08-07). Step 3 check-1 (branch-prefix `ci-fix/131382-`) should have caught it. https://github.com/dotnet/runtime/pull/131981#issuecomment-5293776596
- **#132541** (merged 2026-08-20, `jkoritzinsky`) established the `ci-fix/-...` branch-naming contract so the branch prefix is the deterministic dedup key — but it did not fix how that key is *read* during enumeration.

## Proposed edits

- `.github/workflows/ci-failure-fix.md:164` — Step 3 enumeration: `search_pull_requests` never returns `head.ref`, so the branch-prefix key added by #132541 is invisible to search alone. Instruct the fixer to resolve head branches with `list_pull_requests` (open PRs, `fields` incl. `head`) and `pull_request_read get` (merged/closed candidates) before relying on the prefix, and to never treat a `#`-title match as a substitute for the branch key.
- `.github/workflows/ci-failure-fix.md:166` — Step 3 check 1: clarify that an empty branch map means "not yet enumerated", not "no open PR", so the fixer enumerates head branches before concluding no open PR exists.

## Expected behavior change

The next fixer run will obtain each candidate `[ci-fix]` PR's `head.ref` via `list_pull_requests`/`pull_request_read get` rather than falling back to the GitHub-search `#`-tokenized title match, which drops the leading `#` and is unreliable. This closes the residual dedup gap that allowed help-wanted PR #131981 to be filed against KBE #131382 while #131515 was already open — the fixer will detect the open `ci-fix/131382-` branch and skip with `open fix PR # already exists` instead of opening a duplicate.

> [!NOTE]
> AI/Copilot-generated (`ci-scan-feedback`). Prompt-only edit to `.github/workflows/ci-failure-fix.md`.

> Generated by [CI Outer-Loop Failure Scanner — Feedback](https://github.com/dotnet/runtime/actions/runs/32485521271) · opus48 · 308.9 AIC · ⌖ 25.7 AIC · ⊞ 20.6K · [◷](https://github.com/search?q=repo%3Adotnet%2Fruntime+%22gh-aw-workflow-id%3A+ci-failure-scan-feedback%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** The process '/usr/bin/git' failed with exit code 1
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/dotnet/runtime/actions/runs/32485521271)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 32485521271 -n agent -D /tmp/agent-32485521271

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-32485521271/aw-ci-scan-feedback-dedup-branch-field.bundle refs/heads/ci-scan-feedback-dedup-branch-field:refs/bundles/create-pr-ci-scan-feedback-dedup-branch-field-865f327628785ee6-e5a19021
git update-ref refs/heads/ci-scan-feedback-dedup-branch-field-865f327628785ee6 refs/bundles/create-pr-ci-scan-feedback-dedup-branch-field-865f327628785ee6-e5a19021
git checkout ci-scan-feedback-dedup-branch-field-865f327628785ee6
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-dedup-branch-field-865f327628785ee6-e5a19021

# Push the branch to origin
git push origin ci-scan-feedback-dedup-branch-field-865f327628785ee6

# Create the pull request
gh pr create --title '[ci-scan-feedback] Read ci-fix head.ref via list/get, not search, to close dedup gap' --base main --head ci-scan-feedback-dedup-branch-field-865f327628785ee6 --repo dotnet/runtime
```

Start at .github/workflows/ci-failure-fix.md lines 164 and 166, reading Step 3's enumeration and check 1. Update the instructions so candidate head branches come from list_pull_requests and pull_request_read get, and an empty branch map means enumeration has not happened. Done when the workflow no longer treats search title matching as a substitute for the branch key.

Written by the indexing model from the issue text.