ci: run the check with the script from the pull request

.gitea/workflows/depends_upstream.yaml

@@ -3,6 +3,11 @@
 # main branch matches, so a pull request waiting for gitea cannot be merged.
 # It is a workflow of its own so that a label change does not cancel the build
 # and the preview deployment of the `checks` workflow in test.yaml.
+#
+# The check script comes from the pull request, like the workflow file itself:
+# `pull_request` runs both from the head, so taking the script from the base
+# branch would not gain anything and would leave this workflow unable to run on
+# the pull request that adds it.
 name: checks
 
 on:
@@ -25,9 +30,6 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          # the check script is taken from the base branch: a pull request must
-          # not be able to weaken its own gate
-          ref: ${{ github.event.pull_request.base.ref }}
           persist-credentials: false
       - name: check the upstream dependencies
         env: