apply_samples.cjs ignores target-repo when fetching PR for push_to_pull_request_branch samples in siderepo workflows

## Summary

Two siderepo push-to-PR-branch workflow-dispatch tests in [githubnext/gh-aw-test](https://github.com/githubnext/gh-aw-test) fail persistently on every matrix run (failing since run [27847637501](https://github.com/githubnext/gh-aw-test/actions/runs/27847637501)):

- `test-copilot-siderepo-push-to-pull-request-branch-using-dispatch`
- `test-copilot-siderepo-sparse-push-to-pull-request-branch-using-dispatch`

Failing in all four matrix entries (main/samples=true, main/samples=false, pre-release, release). Previous issues #37546 and #37545 were closed but the bug persists.

---

## Root cause — non-sparse variant

**Run:** [28080402724](https://github.com/githubnext/gh-aw-test/actions/runs/28080402724)

The test creates a PR in `githubnext/gh-aw-side-repo` (not the host repo `githubnext/gh-aw-test`). The e2e harness dispatches the workflow with `pull_request_number=447` as an input. The lockfile's `GH_AW_SAMPLES` env var correctly resolves to:

```json
[{
"tool": "push_to_pull_request_branch",
"arguments": {
"message": "Multi-commit test push from Copilot in side repo",
"pull_request_number": "447"
},
"sidecars": { "patch": "..." }
}]
```

But `apply_samples.cjs` then fetches:

```
[warning] apply_samples: GET https://api.github.com/repos/githubnext/gh-aw-test/pulls/447 returned HTTP 404
[error] Error: apply_samples: cannot derive pull-request head branch for sample[0] (tool=push_to_pull_request_branch).
Trigger the workflow from a pull_request event, or set arguments.pull_request_number on the sample entry,
or provide GITHUB_TOKEN so the PR can be fetched.
at preStagePatch (apply_samples.cjs:361:13)
at async main (apply_samples.cjs:542:7)
```

It fetches PR #447 from `GITHUB_REPOSITORY` (`githubnext/gh-aw-test`) instead of the side-repo (`githubnext/gh-aw-side-repo`).

The `GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG` (set in the `safe_outputs` job) **does** correctly contain `"target": "447", "target-repo": "githubnext/gh-aw-side-repo"`. The config file at `GH_AW_SAFE_OUTPUTS_CONFIG_PATH` (which the agent job reads) also has `"target": "${GH_AW_INPUT_PULL_REQUEST_NUMBER}", "target-repo": "githubnext/gh-aw-side-repo"` — but `apply_samples.cjs` does not use this information when deriving the PR branch.

Note: `GITHUB_TOKEN` is present, and `GH_AW_REPO_TOKENS` includes `{"githubnext/gh-aw-side-repo": "***"}`. The issue is purely that `apply_samples.cjs` constructs the PR fetch URL from `GITHUB_REPOSITORY` only, ignoring `target-repo`.

---

## Root cause — sparse variant

**Run:** [28080402587](https://github.com/githubnext/gh-aw-test/actions/runs/28080402587)

Different failure mode: `apply_samples.cjs` succeeds ("1 sample(s) replayed successfully"), but the `safe_outputs` job fails with:

```
##[error] Cannot push to pull request branch: patch modifies protected files (README.md).
Add them to the allowed-files configuration field or set protected-files: fallback-to-issue
to create a review issue instead.
```

The sparse sample's patch only touches `src/sparse-test.py`, not `README.md`. This is unexpected. Possible causes:
- The test-PR branch in the side repo has accumulated a `README.md` diff from a stale previous run, and the protected-files check evaluates the full PR diff (not just the incoming patch).
- Or `apply_samples.cjs` is emitting a different patch than intended.

---

## Suggested fix (non-sparse)

When `apply_samples.cjs` processes a `push_to_pull_request_branch` sample and needs to fetch the PR head branch, it should use `target-repo` from the safe-outputs config (available in the config file at `GH_AW_SAFE_OUTPUTS_CONFIG_PATH`) rather than always using `GITHUB_REPOSITORY`. As a fallback, it could also try repos listed in `GH_AW_REPO_TOKENS` when the primary fetch returns 404.