docs(ci): state the actual prefetch policy in the module and manifest documentation

The module docstring, the prefetch function docstring, the static-guard comment and the manifest header still said the step runs only for a default-branch
push and never for pull requests. Actual policy: a default-branch push, or a same-repository pull request whose forge-supplied head commit is an exact entry
of the binding's reviewed_commits (empty by default, so inert); no forks, other commits, tags or feature-branch pushes; no cache writes; the credential
exists only in the prefetch helper and its Maven child, never in verification or image steps. Documentation only; no behavior or test change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

platform_ci/package_prefetch.py

@@ -9,8 +9,9 @@ and as which registry user. Nothing here branches on a repository name; an empty
 The credential exists in exactly one place: the environment of the ONE Maven prefetch process of this step (`CI_PACKAGE_READ_TOKEN`). The settings file that
 names it holds only the placeholder `${env.CI_PACKAGE_READ_TOKEN}`, lives in a scratch directory outside the checkout and is deleted before this step returns,
 so the verification step that follows (the app's tests) never receives the token or credentialed settings: it resolves everything from the local repository the
-prefetch filled, with the credential-free public settings. The step runs only for a push to the repository's default branch, never for pull requests, forks,
-tags or feature branches, and it never runs in an image job.
+prefetch filled, with the credential-free public settings. The step runs only for a push to the repository's default branch, or for a SAME-REPOSITORY pull request
+whose forge-supplied head commit is an exact entry of the binding's `reviewed_commits` (empty by default, so inert); never for a fork, another commit, a tag or a
+feature-branch push, and it never runs in an image job. Neither path writes the dependency cache.
 """
 
 import json
@@ -118,7 +119,8 @@ def prefetch_packages(
 ) -> list[str]:
    """Authorize, then resolve the target's dependencies and plugins into the local Maven repository with the read credential; return log lines.
 
-   Refuses unless the event is a push to the default branch, the binding authorizes this repository and the token is present. The credentialed settings
+   Refuses unless the binding authorizes this repository, the event is a push to the default branch or a same-repository pull request at an exact reviewed commit
+   (checked before anything else runs), and the token is present. The credentialed settings
    never leave a scratch directory and are removed even when Maven fails; the token never reaches any process but the one Maven run.
    """
    binding_name = target.get("package_reads", "")
@@ -193,7 +195,7 @@ def _refuse_unsafe_maven_inputs(source_directory: Path, component_directory: Pat
 
    Checked statically, before the token exists in any process: `.mvn` launch files in the component directory and every directory up to the source root
    (extensions, JVM options, Maven options), and every `pom.xml` below the component directory: build extensions, a reference to the credential variable, and a repository that claims the registry id with another URL. Published parent and BOM POMs are resolved by Maven and cannot be checked here; that residual is
-   accepted because the step runs only for reviewed, merged code on the default branch, with a token that can only read packages.
+   accepted because the step runs only for the default branch or an exact reviewed commit, with a token that can only read packages.
    """
    source_root = source_directory.resolve()
    directory = component_directory.resolve()

runtime/package-reader-bindings.yaml

@@ -2,8 +2,9 @@
 #
 # A consumer repository's `.ci.yaml` names a logical binding (`components.<name>.package_reads.binding`). This file decides who may use it: which
 # repositories' runs may use the one repository secret slot the shared workflow forwards to the `prefetch-packages` step ALONE, and as which registry
-# user the token authenticates. The step runs only for a push to the repository's default branch (never pull requests, forks, tags, feature branches
-# or image jobs), fills the local Maven repository with the component's dependencies and plugins, then deletes the credentialed settings; the
+# user the token authenticates. The step runs only for a push to the repository's default branch, or for a same-repository pull request whose forge-supplied
+# head commit is an exact entry of the binding's `reviewed_commits` (empty by default, so inert); never for forks, other commits, tags, feature-branch pushes
+# or image jobs, and neither path writes the dependency cache. It fills the local Maven repository with the component's dependencies and plugins, then deletes the credentialed settings; the
 # verification that follows never sees the token. The registry is https://git.kof22.com/api/packages/QRun-IO/maven.
 #
 # Operator prerequisites (none is created by this repository; no credential value is recorded anywhere):