In a fork's clone origin/main is the fork: once pushed it is HEAD, and
profile_sync --changed --strict checked nothing and passed while the PR's
CI then failed. The default base is now the line validate_pr.py reads:
upstream/main or origin/main when that remote is the project, the
project's main fetched otherwise.