Securing AI Pull Requests: Building a Deterministic AST Audit Harness in GitHub Actions