CI: make CIT tests-report mandatory for docs build & finalize secure fork-PR checkout (follow-up to #346)

## Context

Follow-up to the CI breakage observed in #346. The **Documentation** workflow (`.github/workflows/docs.yml`) runs on `pull_request_target` and calls the local `component_integration_tests.yml` (`cit-tests`) to produce the `tests-report` artifact used by `build-docs` for traceability links.

### What broke
`actions/checkout` **v4.4.0** (released ~2026-07-20) backported the `pull_request_target` fork-checkout block (`allow-unsafe-pr-checkout`, originally shipped in v7.0.0 on 2026-06-18, see the [changelog](https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/)). Because `component_integration_tests.yml` used the floating `actions/checkout@v4` tag, `cit-tests` started **refusing to check out fork PR code**, so no `tests-report` was produced and `build-docs` failed with `Artifact not found for name: tests-report`.

### Temporary mitigation already applied (Part A)
Pinned `actions/checkout` to **v4.2.2** (`11bd71901bbe5b1630ceea73d27597364c9af683`) in `component_integration_tests.yml`, matching the rest of the org (`cicd-workflows/tests.yml` @ v4.2.2, `cicd-workflows/docs.yml` @ v6.0.2). This restores fork-PR CI but keeps the underlying `pull_request_target` fork-checkout ("pwn request") risk and will age out.

## Goal of this ticket (Part B)

Decide and implement the **final** solution, with two requirements:

1. **Make `tests-report` mandatory.** If `cit-tests` does not produce the report:
- `build-docs` must **not** run (drop `if: always()`; require `needs.cit-tests.result == 'success'`).
- `cit-tests` must **fail loudly** (remove `if: always()` masking on report prep/upload; set `if-no-files-found: error`).
2. **Secure the fork-PR checkout** rather than relying on a pinned pre-block checkout version.

### Options to evaluate for requirement 2
- **Pin-old-checkout** (current Part A state) — lowest effort, but keeps the unsafe pattern and only defers the problem.
- **`allow-unsafe-pr-checkout: true`** — explicit opt-in; risky here because `docs.yml` uses `secrets: inherit` + `contents: write` while running fork code.
- **Decouple (preferred to investigate)** — do not run fork code under `pull_request_target`. Reuse the `tests-report` from the safe `pull_request`-triggered `component-integration-tests` run (cross-workflow artifact via `run-id`), or restructure via `workflow_run`. Most secure; more work.

## Acceptance criteria
- [ ] Final approach for secure fork-PR checkout chosen and documented.
- [ ] `build-docs` is skipped when `cit-tests` fails / report missing.
- [ ] `cit-tests` fails when no `tests-report` is generated (`if-no-files-found: error`, no `always()` masking).
- [ ] Fork PRs from external contributors pass docs build end-to-end.
- [ ] Temporary checkout pin from Part A removed/superseded.

## References
- PR #346
- `actions/checkout` v4.4.0 breaking change / changelog: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/