fix(ci): split Docs AI Review comment into workflow_run workflow

Pull requests from forks run pull_request workflows with a read-only
GITHUB_TOKEN regardless of declared permissions, so the inline comment
step could never post on fork PRs and returned 403 on both GraphQL
and REST comment endpoints. Split the flow following the GitHub
workflow_run pattern:

- docs-ai-review.yml (pull_request trigger) now only prepares the
  packet and uploads it as an artifact, together with a pr-metadata
  JSON describing the PR number, head SHA, base SHA and trigger name.
  It no longer tries to comment.
- docs-ai-review-comment.yml (workflow_run trigger on the first
  workflow) downloads the artifact from the completed run, parses the
  metadata, and upserts the advisory comment via REST. Because
  workflow_run runs in the base-repo context, its GITHUB_TOKEN honors
  the declared issues: write permission even for fork-originated PRs.

The comment workflow does not check out or execute any code from the
fork. It only consumes the prebuilt packet and metadata JSON, which
avoids the security footgun usually associated with giving write
permissions to fork-triggered runs.

Author: morningman

.github/workflows/docs-ai-review.yml

@@ -118,64 +118,3 @@ jobs:
             website-quality-governance/generated/ai-review-packet.json
             website-quality-governance/generated/pr-metadata.json
           if-no-files-found: error
-
-  upsert-advisory-comment:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    needs: prepare-docs-ai-review
-    if: needs.prepare-docs-ai-review.result == 'success'
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: read
-    steps:
-      - name: Download review packet artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: docs-ai-review-packet-${{ needs.prepare-docs-ai-review.outputs.pr_number }}
-          path: website-quality-governance/generated
-
-      - name: Upsert advisory PR comment
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ needs.prepare-docs-ai-review.outputs.pr_number }}
-          HEAD_SHA: ${{ needs.prepare-docs-ai-review.outputs.head_sha }}
-          BASE_SHA: ${{ needs.prepare-docs-ai-review.outputs.base_sha }}
-          TRIGGER_NAME: ${{ github.event_name }}
-        run: |
-          marker='<!-- docs-ai-review:packet -->'
-          changed_count=$(jq '.changed_files | length' website-quality-governance/generated/ai-review-packet.json)
-          high_risk=$(jq -r '.high_risk.required' website-quality-governance/generated/ai-review-packet.json)
-          agent_count=$(jq '.review_agents | length' website-quality-governance/generated/ai-review-packet.json)
-
-          cat > /tmp/docs-ai-review-comment.md <<EOF
-          $marker
-          Docs AI review packet prepared for this PR.
-
-          - Trigger: \`$TRIGGER_NAME\`
-          - Changed files in packet: \`$changed_count\`
-          - High-risk docs path matched: \`$high_risk\`
-          - Review agents included: \`$agent_count\`
-          - Base SHA: \`$BASE_SHA\`
-          - Head SHA: \`$HEAD_SHA\`
-
-          This MVP uploads the packet as a workflow artifact for advisory AI review. AI findings, when produced, are suggestions only; deterministic governance CI remains the blocking signal.
-          EOF
-
-          existing_comment_id=$(
-            gh api repos/${{ github.repository }}/issues/${PR_NUMBER}/comments \
-              --jq ".[] | select(.user.type == \"Bot\" and (.body | contains(\"$marker\"))) | .id" \
-              | tail -n 1
-          )
-
-          if [ -n "$existing_comment_id" ]; then
-            gh api \
-              --method PATCH \
-              repos/${{ github.repository }}/issues/comments/${existing_comment_id} \
-              -f body="$(cat /tmp/docs-ai-review-comment.md)"
-          else
-            gh api \
-              --method POST \
-              repos/${{ github.repository }}/issues/${PR_NUMBER}/comments \
-              -f body="$(cat /tmp/docs-ai-review-comment.md)"
-          fi