Scope the Bar comment job to pull requests instead of issues

[gowtham0992]

Narrows the comment job's write scope and stops GitHub error bodies from
reaching the Actions log unfiltered.

Permission

Job	Before	After
investigate	actions: read, contents: read, pull-requests: read	unchanged
comment	contents: read, issues: write	contents: read, pull-requests: write

issues: write granted write access to every issue in the repository,
while the job only ever comments on the pull request the collector
validated against GitHub. pull-requests: write covers commenting on a
pull request through the issue-comments endpoint and nothing more, so a
wrong pull request number can no longer land on an unrelated issue.

The investigation job is untouched and remains read-only. The comment
job still receives no BAR_ACCESS_* and no Actions read.

Stronger permission assertions

The tests now compare each job's entire permissions block for equality
instead of searching for substrings. A substring test passes when an
extra scope is added, because the line it looks for is still there.

Verified by mutation — every one of these now fails the test:

• both issues: write and pull-requests: write on the comment job
• issues: write restored on the comment job
• actions: read added to the comment job
• contents: write on the comment job
• issues: write added to the investigation job
• investigation pull-requests: read promoted to write

GitHub error reporting

A GitHub error body is untrusted input that lands in the Actions log.
Errors now report only two projected fields:

• message — NFKC-normalized, line breaks folded to spaces, control
  and format characters removed, URLs and bare domains replaced, and
  @ < > : & stripped so no mention, HTML, or workflow command can
  form. Bounded to 160 characters.
• documentation_url — rebuilt from validated components, and only
  when it is a canonical HTTPS URL on docs.github.com with no
  userinfo, port, backslash, whitespace, or non-ASCII.

No other response field is echoed.

Verified against hostile inputs: ::error:: and ::add-path::
injection, mentions, HTML, external URLs, bare domains, bidi overrides,
zero-width characters, control bytes, multiline bodies, and a 4,000
character message. Zero escapes. Every hostile documentation_url was
rejected, including docs.github.com@attacker.example,
docs.github.com.attacker.example, a trailing-dot host, an explicit
port, embedded credentials, javascript:, and backslash paths.

Verification

Comment tests 26 passed, collector tests 37 passed, full suite 1073
passed, release hygiene passed, hygiene tests 11 passed, ruff clean,
actionlint clean, git diff --check clean.