Fix tf-plan: checkout PR head branch after expand push (#90)

## Summary
Same fix as #89 but for `tf-plan.yml`. When `expand-terraform` pushes
regenerated files to the PR branch, `tf-plan` must checkout the updated
branch HEAD (`github.head_ref`), not the stale merge ref (`github.ref`)
captured at workflow trigger time.

Without this, tf-plan validates against old generated files that don't
reflect app.yaml changes.

## Test plan
- [ ] Merge this, then re-run test app PR CI

Author: Alexanderamiri

.github/workflows/tf-plan.yml

@@ -51,7 +51,7 @@ jobs:
 
       - uses: actions/checkout@v6
         with:
-          ref: ${{ github.ref }}
+          ref: ${{ github.head_ref || github.ref }}
 
       - uses: hashicorp/setup-terraform@v4
         with: