Checkout spel's own source in reusable build workflow

[lorengordon]

Problem

When build.yml is invoked as a reusable workflow via workflow_call from another repository (e.g. amigen9), the bare actions/checkout steps in the build and release-pr jobs default to checking out ${{ github.repository }}@${{ github.sha }}. In a workflow_call context, those default context values resolve to the calling repository/ref (e.g. amigen9), not spel's own.

This caused CI failures such as:

make: Makefile.spel: No such file or directory
make: *** No rule to make target 'Makefile.spel'.  Stop.

because Makefile.spel only exists in spel's own repository.

The release-pr job has the same bug: it would attempt to move manifests into and open a PR against whatever repo happened to invoke the workflow, rather than spel's own manifests/ directory and .bumpversion.cfg.

Fix

Pin both checkout steps to job.workflow_repository / job.workflow_sha, which per GitHub's contexts reference always resolve to the repository and commit that define the current job (i.e. spel's own build.yml), regardless of which repository or ref invoked the workflow. This is GitHub's documented pattern for reusable workflows that need to access files co-located with the workflow definition.

The manifests job is unaffected since it only merges uploaded artifacts and has no checkout step.

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.