[Bug] CI accepts obsolete PR targets after retargeting or force-push #3296

Problem

On Apache master 68855199031d5801edb4fe41b2bacbacffe8fe68, CI accepts an old synthetic merge after a PR is retargeted within the same repository or the target branch is force-pushed to unrelated history. require_current_pr() checks the target repository, but omits the target branch name and whether the tested base remains in the target's history.

Reproduction

Create a local Git fixture with a base commit, a PR head and a two-parent synthetic merge. Build a plan against master, then supply live PR metadata with either a different base ref or an unrelated commit at the same base ref. With unchanged head identity and successful selected results, create_plan() and the all, memory and advisory gates accept the obsolete snapshot. A changed-head control is correctly rejected.

Expected behavior

Bind the plan to its target ref and reject rewritten target history. Continue to allow normal target-branch advancement, consistent with non-strict protection, and preserve the documented metadata-outage policy for completed Memory tests.

Scope and existing work

This concerns CI planning and reporting; the fixture does not establish that GitHub branch protection can be bypassed. Existing issues and PRs were searched for retargeting, force-push and plan freshness. Merged CI changes #3271 and #3277 retain the gap; no active fix was found. The earlier report is in the Topling review.