ci: report ctx analysis on pull requests

[saldestechnology]

Summary

• run a read-only, fork-safe ctx analysis for every PR revision
• publish a sanitized, stale-safe sticky ctx report from a trusted workflow_run job
• include audit, score, duplicates, architecture checks, hotspots, repository stats, and map results
• retain the complete JSON analysis as a 14-day workflow artifact

Security

The write-enabled commenter never checks out or executes PR code. It validates the PR, head/base SHAs, repository, run ID, schema, ctx version, and command envelopes against trusted workflow_run data before publishing.

Validation

• node --test .github/scripts/render-ctx-pr-comment.test.cjs (4 passed)
• real ctx 0.3.4 analysis bundle rendered successfully (5,731-character comment)
• cargo test -- --skip embeddings:: (all relevant suites passed; existing sandbox-sensitive self-update socket tests cannot bind locally)
• workflow YAML parse and git diff --check