Fetch PR body inside checker

Authored-By: Codex (GPT-5) <noreply@openai.com>

README.md

@@ -36,7 +36,6 @@ jobs:
           head-branch: ${{ github.head_ref }}
           pr-title: ${{ github.event.pull_request.title }}
           pr-author: ${{ github.event.pull_request.user.login }}
-          pr-body: ${{ github.event.pull_request.body }}
           server-url: ${{ github.server_url }}
           token: ${{ github.token }}
           base-sha: ${{ github.event.pull_request.base.sha }}
@@ -53,7 +52,6 @@ job — the step still fails, but the job cannot block the PR.
 | `head-branch` | yes | Head branch name — `github.head_ref` |
 | `pr-title` | yes | PR title — `github.event.pull_request.title` |
 | `pr-author` | no | PR author login — `github.event.pull_request.user.login`; `dfritz` is exempt |
-| `pr-body` | yes | PR description — `github.event.pull_request.body` |
 | `server-url` | yes | Gitea server URL — `github.server_url` |
 | `token` | yes | Gitea Actions token — `github.token` |
 | `base-sha` | yes | Base commit — `github.event.pull_request.base.sha` |
@@ -75,8 +73,9 @@ The check validates four things for every non-break-glass Agent PR:
    `Fixes bug-<id>` automation token and the matching navigable
    `https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate
    `## Attribution` section containing the canonical `Authored-By`
-   product/model watermark. The action asks Gitea to render the body with a
-   bounded 5-second connection and 15-second total wait, then checks visible
+   product/model watermark. The action loads the body from Gitea by repository
+   and PR number, then asks Gitea to render it; both calls have a bounded
+   5-second connection and 15-second total wait. It then checks visible
    `<h2>` sections outside collapsed `<details>` content. Fenced, commented,
    scripted, or collapsed copies do not satisfy the visible provenance contract.