fix(api): enforce public-only scope for compare heads (#39006)

Enforce public-only token scope for repositories resolved as compare
heads.

_Assisted-by: Codex:GPT-5_

routers/api/v1/repo/pull.go

@@ -1094,6 +1094,10 @@ func parseCompareInfo(ctx *context.APIContext, compareParam string) (result *git
 		ctx.APIErrorInternal(err)
 		return nil, nil
 	}
+	if !ctx.TokenCanAccessRepo(headRepo) {
+		ctx.APIErrorNotFound()
+		return nil, nil
+	}
 
 	isSameRepo := baseRepo.ID == headRepo.ID