fix: repair touchstone benchmark CI

[schochastics]

The touchstone benchmark CI added in #2685 failed on its first run (example). Three linked problems:

1. Receive workflow skipped every maintainer PR (root cause)

prepare gated on author_association == OWNER/MEMBER/COLLABORATOR. That value comes from the pull_request webhook payload, which reports CONTRIBUTOR/NONE (never MEMBER) for maintainers whose org membership is private — so the gate was false, both jobs skipped, and no "pr" artifact was produced.

→ Gate on the PR head being a same-repo branch instead. Creating a same-repo branch requires push access, so this is the real security boundary against untrusted fork code, and it's immune to membership visibility.

2. Comment workflow crashed instead of no-op'ing (the visible error)

It only checked workflow_run.event == 'pull_request', so it ran after the skipped receive run and died downloading the missing artifact: Cannot read properties of undefined (reading 'id').

→ Also require workflow_run.conclusion == 'success'.

3. Deprecated ::set-output (latent)

Would have left needs.prepare.outputs.config empty once prepare actually ran, breaking the fromJson build matrix.

→ Switch to $GITHUB_OUTPUT, compacting config.json with jq -c (drops the multi-line escaping hack).

This PR touches .github/workflows/touchstone-*.yaml, which is in the receive trigger's path filter, so it exercises the fixed workflow itself.

🤖 Generated with Claude Code

[schochastics]

Validation status

The receive workflow runs from the PR branch and is fully green here: it ran the benchmarks and uploaded the pr, results, and visual-benchmarks artifacts (run). This validates the three receive-side fixes (same-repo gate, $GITHUB_OUTPUT, SHA pin).

The comment workflow is workflow_run-triggered, which GitHub always runs from the default branch (main) — never from the PR branch. So the "Continuous Benchmarks (Comment)" check on this PR still executes the old main code (comment@v1 + github-script@v3) and fails with 401 InvalidAuthenticationInfo while downloading the artifact from Azure storage — the exact bug fixed by pinning to a commit that uses actions/download-artifact@v5.

That red check is expected and cannot turn green until this PR is merged. The pinned comment action is a verified drop-in (same GITHUB_TOKEN input; replaces the hand-rolled github-script download with actions/download-artifact@v5). After merge, the next PR touching R/** / touchstone/** will exercise the full receive → comment flow end-to-end.