[ci] Fix docs-go scope guard to diff against the PR base branch

The docs-go scope guard computed its diff base as the merge-base with a
hardcoded origin/master. On a release-branch backport (base releases/X.Y),
that merge-base is where the release branch diverged from master, so the diff
includes every change that landed on the release branch but not master. A
genuinely content-only doc backport is then flagged with the release branch's
non-doc changes and the guard fails a valid PR.

Diff against ${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-master} instead, matching
ci/lint/lint.sh and ci/pipeline/determine_tests_to_run.py. On a normal PR the
base is master and behavior is unchanged; on a backport it correctly scopes to
the files the PR actually adds.

Signed-off-by: Douglas Strodtman <douglas@anyscale.com>

Author: dstrodtman

ci/lint/validate_docs_go_scope.sh

@@ -46,9 +46,18 @@
 
 set -uo pipefail
 
-git fetch --depth=500 origin master >/dev/null 2>&1 || true
-if ! base="$(git merge-base origin/master HEAD 2>/dev/null)"; then
-  echo "docs-go scope guard: could not determine merge-base with origin/master; failing closed."
+# Diff against the PR's actual base branch, not a hardcoded master. On a
+# release-branch backport the merge-base with master is where the release
+# branch diverged, so diffing against master attributes every release-only
+# change to the PR and the guard fails a genuinely content-only backport.
+# BUILDKITE_PULL_REQUEST_BASE_BRANCH is the base the PR targets; fall back to
+# master for local runs, matching ci/lint/lint.sh and
+# ci/pipeline/determine_tests_to_run.py.
+base_branch="${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-master}"
+
+git fetch --depth=500 origin "${base_branch}" >/dev/null 2>&1 || true
+if ! base="$(git merge-base "origin/${base_branch}" HEAD 2>/dev/null)"; then
+  echo "docs-go scope guard: could not determine merge-base with origin/${base_branch}; failing closed."
   exit 1
 fi