Comment Bar's diagnosis on the pull request from a write-scoped job

[gowtham0992]

Posts Bar's diagnosis back to the pull request, from a job that can write
comments and nothing else.

Trust boundary

permissions: {} at the workflow level, granted per job:

Job	Permissions	Holds
investigate	actions: read, contents: read, pull-requests: read	Bar credentials, evidence
comment	contents: read, issues: write	one encoded payload

The comment job receives no BAR_ACCESS_*, no evidence text, and no
Actions read, since GITHUB_TOKEN is scoped by the job's own
permissions. Both jobs check out github.workflow_sha with a SHA-pinned
actions/checkout and persist-credentials: false.

The payload crosses as a job output consumed through env:, never
interpolated into a run: line. It is base64url with padding stripped,
so its alphabet cannot express a newline or a workflow command, and the
8 KiB cap is enforced on the encoded length.

Destination authority

The comment target is the pull request the collector already validated
against GitHub: same repository, head SHA matching the run. Bar's
returned pull request number is cross-checked against that and rejected
on mismatch. It is never used to select where to comment, so a wrong
answer from Bar cannot redirect the comment to another issue.

Hostile model text

Diagnosis prose is NFKC-normalized first, so fullwidth forms unfold
before filtering. Line breaks become spaces; other control and format
characters are deleted, which keeps zero-width and bidi obfuscation from
surviving as separate words. URLs and bare domains are replaced, @,
<, >, & fold to lookalikes, and the result is Markdown-escaped.

Verified against 19 attack classes — mentions, HTML, Markdown links and
images, bare URLs and domains, javascript:, data:, fullwidth-encoded
URLs, bidi overrides, zero-width splits, newline and marker injection,
control characters, entities, tables, quotes, backticks. Zero escapes.
Worst-case rendering, four jobs with every field at maximum length and
entirely escapable, is 6,007 bytes against the 12 KiB cap.

Polling

GET only, so it cannot start, retry, or duplicate a Workflow or model
call. Bounded by a deadline, an 8 KiB response cap, and at most four
investigations. Summaries are checked field by field against the
collector's run, attempt, and pull request.

A total timeout produces a bounded "diagnosis unavailable" comment
instead of failing the job, because evidence ingestion succeeded and a
rerun updates the same comment in place. TLS certificate failures are
permanent rather than retried, so an intercepted connection is not
reported as an ordinary timeout.

Comment identity

One marker comment per pull request. A marker registers only when
github-actions[bot] authored it, so a user pasting the public marker
is ignored rather than wedging updates; two bot-authored markers still
fail closed. Ambiguous writes re-look-up and verify comment identity and
body before retrying, so a lost response cannot duplicate.

Release hygiene

Two narrow allowlist entries for the CI-only scripts that make outbound
calls. tests/test_bar_pr_comment.py drives fakes and needs no
exemption. Neither script ships: the wheel packages only link_mcp and
link_core.

Verification

Release hygiene passed, hygiene tests 11 passed, comment tests 24
passed, collector tests 37 passed, full suite 1071 passed, ruff clean,
actionlint clean, git diff --check clean.