refactor: remove the action-owned PR comment fallback — the App owns the PR comment

[jadoonf]

Summary

Follow-up to #140 (stacked on its branch): the action stops posting its own fallback PR comment — the companion GitHub App owns the Runtime Review comment; the action owns recording, submission, and the job's Step Summary (unchanged, goldens byte-identical). Net −8.9k lines.

Removed (comment-only machinery)

• pr-comment.js, pr-comment-plan.js, pr-comment-error.js, github-issue-comment-client.js, and the comment-state half of profile-comment.js (markers, cross-commit merge/diff state, renderCommentBody reconciliation) plus publishProfilerComment and githubToken state plumbing in post.js. This also deletes the comment-trust attack surface security: validate untrusted inputs and harden comment trust and Markdown link sinks #140 had to harden (marker spoofing, author filtering) instead of patching it.
• Client-side mirrors of server policy: publicationDecision (public-run 404 policy), CONTROL_PLANE_MARKERS, the internal public-Run-Profile mockup.
• runtime-review-vocab.js de-prosed to values-only: the vendored contract now carries just the strings/limits the renderer consumes; internal testbed rulings/rationale prose stays in the private testbed. Runtime values are unchanged (contract 6.10.0 asserted in tests).

Kept

• Profile parse/normalize, renderStepSummary/renderPendingReview, and the public profile permalink (now in report-link.js, utm_medium=ci_log since the link renders in the CI log/summary, not a comment).
• All of security: validate untrusted inputs and harden comment trust and Markdown link sinks #140/main's Jibril acquisition + checksum + gh attestation verify + OIDC-default behavior; github_token input retained solely for gh attestation verify.

Docs/config

• action.yaml + README: the App owns the PR comment; pull-requests: write dropped from examples, permissions table, and the smoke workflows; no-auth path documented as best-effort local Step Summary.

- post: readProfile → appendRuntimeReviewSummary → publishProfilerComment(...)
+ post: readProfile → appendRuntimeReviewSummary → logProfileReportLink(...)

Dependabot instrumentation note (this repo): the Run Garnet step runs first in CI on Dependabot PRs, but live evidence from #144's run (job 33503608938) shows it degrades to unmonitored: Dependabot-triggered pull_request runs get neither Actions secrets nor a usable OIDC grant ("Input 'api_token' is required when OIDC authentication is unavailable"). Fix is repo-admin, not code: mirror GARNET_API_TOKEN into the repository's Dependabot secrets store — ci.yaml already passes secrets.GARNET_API_TOKEN, which resolves from that store on Dependabot runs.

npm run validate green (typecheck + 52 tests + build); dist/ rebuilt.

Link to Devin session: https://app.devin.ai/sessions/3ab2e708c38e478dad8aa472a81c8fcc
Open in Devin Desktop: https://app.devin.ai/desktop/session/3ab2e708c38e478dad8aa472a81c8fcc?variant=devin
Requested by: @jadoonf

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring