ci(checks): serialize render after lock-update gate

[dmcilvaney]

NOTE: Requires #17247 and an associated cherry-pick of the stub into the default branch: #17249

Today the 'render' and 'update_locks' jobs run in parallel and each operates on the full distro. That keeps the gate honest but leaves no room to scale render with PR size, because we have no trustworthy 'what did this PR touch' signal: 'azldev component changed' reads input fingerprints that include lock content, so its output is only reliable when locks are known-clean.

Serializing render behind a successful lock check unlocks that optimization. With a green locks gate, the follow-up commit can shrink render to just the PR-touched components and have CI confidence in the result.

The serialization is also defensive in its own right: if locks were stale, a parallel full-distro render would produce output against the wrong upstream pins, and maintainers would chase a phantom drift report that disappears the moment locks are fixed.

Skip the render PR comment when render itself was skipped (no report artifact to post; the locks PR comment already carries the fix).

Also plumb pull_request.base.sha through stub -> reusable workflow as 'pr-base-sha'. No consumer yet -- the follow-up render-scope commit needs the base SHA to compute the diff range. Declared as required now so the stub contract is stable when the consumer lands.

[Copilot]

Pull request overview

This PR updates the rendered-specs CI workflow to run the lock-update gate before the render drift check, so stale locks prevent render from running and producing misleading drift output.

Changes:

• Adds pr-base-sha plumbing from the stub into the reusable workflow for future scoped-render work.
• Reorders the reusable workflow so render depends on update_locks.
• Skips the render comment job when render is skipped due to lock-check failure.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/check-rendered-specs.yml	Serializes render after lock checking and updates render comment conditions.
.github/workflows/check-rendered-specs-stub.yml	Passes the PR base SHA into the reusable workflow.

Comments suppressed due to low confidence (1)

.github/workflows/check-rendered-specs.yml:245

• This comment refers to a render-scope helper, but this job currently performs an unscoped full render (azldev component render -a --clean-stale) and never uses pr-base-sha. Keeping this as present-tense behavior will mislead future workflow debugging until the scoped helper is actually wired in.

    # Gate render on a clean lock check. `azldev component changed` (used by
    # the render-scope helper) reads input fingerprints that include lock
    # content, so stale locks would steer it toward the wrong scope. Skip