ci: fall back to API for coverage PR diff

[XuPeng-SH]

Cause

The required coverage merge job failed before coverage processing because the public pull-request .diff endpoint returned HTTP 503 through its retry window. A rerun of the same MatrixOne head succeeded, but the workflow had no fallback. Related: matrixorigin/matrixone#29223.

Change

For public repositories, try the public .diff endpoint first, then fall back to the authenticated GitHub Pull Requests API diff endpoint. Both requests have bounded retries and timeouts. The helper verifies the expected PR head and diff statistics before and after download. It accepts an empty diff only when GitHub reports zero changed files; nonempty responses must parse as Git patches whose file, added-line, and deleted-line counts match PR metadata. It publishes from a temporary file only after validation. The private-repository path is unchanged.

Validation

• bash -n scripts/fetch_public_pr_diff.sh; Ruby Psych parsed the changed workflow; git diff --check passed.
• GitHub Actions validation passed on head 00b4a36, including all 13 tests in scripts/test_fetch_public_pr_diff.py. They cover HTTP 503 fallback, empty and malformed bodies, incomplete file and hunk lists, metadata drift, and cleanup after failure.
• Live fetch while the public endpoint returned HTTP 503: the authenticated API fallback returned a valid diff. A live fetch at head 00b4a36 also returned a Git-parseable 17,800-byte diff matching the four changed files and metadata line counts.

A full MatrixOne Coverage workflow run after merge will verify the reusable-workflow integration.