ci/github-script/prepare: avoid running CI when targeting channel branches

This moves the no-channel-base check into the prepare script to exit
early and prevent all of CI to run against those branches. We also
provide better output by posting a "Changes Requested" review, using the
existing infrastructure from the old cherry-picks check.

The review will be dismissed automatically once the branch has been
corrected, because the commits check will run and do it.

(cherry picked from commit 0601cf6fd0)

.github/workflows/check.yml

@@ -31,20 +31,6 @@ defaults:
     shell: bash
 
 jobs:
-  no-channel-base:
-    name: no channel base
-    if: contains(fromJSON(inputs.baseBranch).type, 'channel')
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: |
-          cat <<EOF
-          The nixos-* and nixpkgs-* branches are pushed to by the channel
-          release script and should not be merged into directly.
-
-          Please target the equivalent release-* branch or master instead.
-          EOF
-          exit 1
-
   commits:
     permissions:
       pull-requests: write

.github/workflows/pr.yml

@@ -23,6 +23,9 @@ permissions: {}
 jobs:
   prepare:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      # wrong branch review comment
+      pull-requests: write
     outputs:
       baseBranch: ${{ steps.prepare.outputs.base }}
       headBranch: ${{ steps.prepare.outputs.head }}
@@ -44,6 +47,7 @@ jobs:
               github,
               context,
               core,
+              dry: context.eventName == 'pull_request',
             })
 
   check: