[ci-scan-feedback] Fix fixer dedup: resolve head.ref via list tools, not search

## Triggering signals

- **#132616** — a prior `[ci-scan-feedback]` PR that recorded this exact fix but whose **git push failed**, so the fix never landed; the issue body preserves the full rationale. https://github.com/dotnet/runtime/issues/132616
- **#131981** — help-wanted `[ci-fix]` PR closed unmerged by `kotlarmilos` (MEMBER) on 2026-08-14: *"Duplicate https://github.com/dotnet/runtime/pull/131515."* Both PRs target KBE **#131382** with the same `WindowsShell` fix on branch `ci-fix/131382-...`; #131515 was already open when #131981 was filed. The Step 3 branch-prefix dedup should have caught it. https://github.com/dotnet/runtime/pull/131981#issuecomment-5293776596
- Rubric finding: `.github/workflows/ci-failure-fix.md:164` instructs the fixer to parse `head.ref` from `[ci-fix]` PRs enumerated **via `search_pull_requests`**, but the `github` MCP `search_pull_requests` tool schema has no `head` field and never returns `head.ref`, so the deterministic branch-prefix dedup key added by #132541 is invisible to search alone.

## Proposed edits

- `.github/workflows/ci-failure-fix.md:164` — Step 3 enumeration: stop parsing `head.ref` from search results. Resolve the branch key with the non-search tools — `list_pull_requests` (`state: open`, `fields` incl. `head`) for open candidates, `pull_request_read get` for specific merged/closed candidates, and a non-integrity-gated `list_branches` backstop to enumerate every live `ci-fix/-...` branch prefix.
- `.github/workflows/ci-failure-fix.md:166` — Step 3 check 1: clarify that an empty branch map means "not yet enumerated", NOT "no open PR", so the fixer enumerates head branches via `list_pull_requests`/`list_branches` before concluding none exists.

## Expected behavior change

The next fixer run obtains each candidate `[ci-fix]` PR's `head.ref` from `list_pull_requests`/`list_branches` (which do expose branches) instead of a `search_pull_requests` field that is always absent, and treats an unpopulated branch map as "not yet enumerated" rather than "no open PR." This closes the residual self-dedup gap that let help-wanted PR #131981 be filed against KBE #131382 while #131515 was already open on `ci-fix/131382-`: the fixer will detect the live branch and skip with `open fix PR # already exists` instead of opening a duplicate.

> [!NOTE]
> AI/Copilot-generated (`ci-scan-feedback`). Prompt-only edit to `.github/workflows/ci-failure-fix.md`.

> Generated by [CI Outer-Loop Failure Scanner — Feedback](https://github.com/dotnet/runtime/actions/runs/33394234113) · opus48 · 280.5 AIC · ⌖ 25.7 AIC · ⊞ 20.6K · [◷](https://github.com/search?q=repo%3Adotnet%2Fruntime+%22gh-aw-workflow-id%3A+ci-failure-scan-feedback%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** The process '/usr/bin/git' failed with exit code 1
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/dotnet/runtime/actions/runs/33394234113)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 33394234113 -n agent -D /tmp/agent-33394234113

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-33394234113/aw-ci-scan-feedback-fixer-dedup-headref.bundle refs/heads/ci-scan-feedback-fixer-dedup-headref:refs/bundles/create-pr-ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2-50a2e321
git update-ref refs/heads/ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2 refs/bundles/create-pr-ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2-50a2e321
git checkout ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2-50a2e321

# Push the branch to origin
git push origin ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2

# Create the pull request
gh pr create --title '[ci-scan-feedback] Fix fixer dedup: resolve head.ref via list tools, not search' --base main --head ci-scan-feedback-fixer-dedup-headref-13d139b40ed0bbf2 --repo dotnet/runtime
```

Read .github/workflows/ci-failure-fix.md around lines 164-166 and review the referenced Step 3 enumeration. Confirm how list_pull_requests, pull_request_read, and list_branches expose branch information, then update the instructions so an unpopulated branch map triggers enumeration rather than a no-PR conclusion. Done means the workflow directs the fixer to resolve head.ref through the listed tools and detect existing ci-fix branches before opening duplicates.

Written by the indexing model from the issue text.