[refactor-opportunist] Extract shared "ensure origin refs" workflow step into a fragment

## 🏗️ Refactor Proposal

**Summary:** Centralize the repeated `Ensure origin refs for PR patch generation` step in a shared fragment and reuse it across PR-modifying workflows.

## Problem
The same 9-line Git remote/ref setup block is duplicated across multiple workflow sources, so behavior changes require synchronized edits and can drift.

Concrete evidence:
- `.github/workflows/gh-aw-mention-in-pr.md` (before at step block around lines 102-110)
- `.github/workflows/gh-aw-mention-in-pr-no-sandbox.md` (before at step block around lines 100-108)
- `.github/workflows/gh-aw-pr-review-addresser.md:84-92`
- `.github/workflows/gh-aw-pr-conflict-addresser.md:92-100`

Churn/co-change signal (last 60 days): these PR-assistant workflow files were repeatedly edited together (`5e6f124`, `f374aab`, `7b41588`, `36593c8`, `a5ecf68`, etc.), increasing copy-paste maintenance overhead.

## Proposed Approach
Introduce one fragment containing the shared origin-refs step and import it from workflows that need PR patch generation.

- **Changes:** Move only the duplicated step body to `gh-aw-fragments/ensure-origin-refs.md` and import it from workflow wrappers.
- **Stays the same:** workflow inputs, permissions, safe-outputs, and prompt behavior.

## Proof of Concept
I partially implemented this refactor on one representative slice to verify viability.

**Files changed:**
- `.github/workflows/gh-aw-fragments/ensure-origin-refs.md` (new)
- `.github/workflows/gh-aw-mention-in-pr.md`
- `.github/workflows/gh-aw-mention-in-pr-no-sandbox.md`
- `.github/workflows/gh-aw-mention-in-pr.lock.yml` (compiled)
- `.github/workflows/gh-aw-mention-in-pr-no-sandbox.lock.yml` (compiled)
- `gh-agent-workflows/DEVELOPING.md` (fragment catalog entry)

**Before → After:**

Before (`gh-aw-mention-in-pr*.md`):
````yaml
steps:
- name: Ensure origin refs for PR patch generation
env:
GITHUB_TOKEN: $\{\{ github.token }}
SERVER_URL: $\{\{ github.server_url }}
REPO_NAME: $\{\{ github.repository }}
run: |
SERVER_URL_STRIPPED="\$\{SERVER_URL#https://}"
git remote set-url origin "(xaccesstoken/redacted):\$\{GITHUB_TOKEN}@\$\{SERVER_URL_STRIPPED}/\$\{REPO_NAME}.git"
git fetch --no-tags --prune origin '+refs/heads/*:refs/remotes/origin/*'
````

After:
- Added import in both workflows: `gh-aw-fragments/ensure-origin-refs.md`
- Removed duplicated inline step blocks
- Shared step now lives once in `.github/workflows/gh-aw-fragments/ensure-origin-refs.md:1-12`

**Verification:**
- `make compile` → success (`0 error(s), 3 warning(s)`)
- `make lint` → success
- `make test` → success (`49 passed`)

## Incremental Rollout Plan
This refactor is incremental:
1. **Completed (POC):** extracted shared origin-ref setup for `mention-in-pr` + `mention-in-pr-no-sandbox`.
2. Migrate remaining duplicates to the same fragment:
- `.github/workflows/gh-aw-pr-review-addresser.md`
- `.github/workflows/gh-aw-pr-conflict-addresser.md`
3. Add a lightweight duplication guard (or checklist item) for critical setup-step fragments to prevent re-inline drift.

## Risks and Mitigations
- **Risk:** import-order side effects in compiled workflows.
- **Mitigation:** extracted only an isolated pre-setup step; compile+lint+tests passed.
- **Risk:** future workflow variants subtly diverge in required fetch behavior.
- **Mitigation:** keep variant-specific behavior in wrappers; only centralize the invariant remote/ref setup.

## Evidence
- Duplicate step references:
- `.github/workflows/gh-aw-pr-review-addresser.md:84-92`
- `.github/workflows/gh-aw-pr-conflict-addresser.md:92-100`
- New shared fragment:
- `.github/workflows/gh-aw-fragments/ensure-origin-refs.md:1-12`
- POC wrapper imports:
- `.github/workflows/gh-aw-mention-in-pr.md` imports include `gh-aw-fragments/ensure-origin-refs.md`
- `.github/workflows/gh-aw-mention-in-pr-no-sandbox.md` imports include `gh-aw-fragments/ensure-origin-refs.md`
- Co-change history command used:
- `git log --since="60 days ago" --oneline -- .github/workflows/gh-aw-mention-in-pr.md .github/workflows/gh-aw-mention-in-pr-no-sandbox.md .github/workflows/gh-aw-pr-review-addresser.md .github/workflows/gh-aw-pr-conflict-addresser.md`

> [!NOTE]
>
> 🔒 Integrity filter blocked 2 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#399](https://github.com/elastic/ai-github-actions/pull/399) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#704](https://github.com/elastic/ai-github-actions/issues/704) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Refactor Opportunist](https://github.com/elastic/ai-github-actions/actions/runs/24035622734)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.