feat: externalize bundle size comments

[jasonsaayman]

Summary

• Remove built-in GitHub PR comment posting and token inputs from the action runtime.
• Add a generated Markdown report alongside the JSON report so workflows can post the exact bundle-size comment body themselves.
• Document same-repository and fork-safe comment workflows that read bundle-size-comparison.md.
• Update OpenSpec, docs, tests, and dist/index.js for the new external-comment flow.

Testing

• pnpm run lint
• pnpm run typecheck
• pnpm test
• pnpm run build
• openspec validate "externalize-pr-commenting" --strict

Checklist

• I updated tests or explained why no test changes are needed.
• I updated documentation when behavior, inputs, outputs, or workflow usage changed.
• I updated dist/index.js when runtime source, dependencies, or action metadata changed.
• I kept JSON report behavior machine-readable and backward-compatible unless intentionally changed.

---

Summary by cubic

Removes built‑in PR commenting and writes a Markdown report so workflows can post bundle‑size comments themselves. This keeps the action read‑only by default and enables fork‑safe commenting.

• New Features

  • Generate a Markdown report alongside JSON (markdown-output-file, default bundle-size-comparison.md).
  • New action output markdown-file with the absolute path to the Markdown report.
  • Docs show same‑repo comment upsert and a fork‑safe workflow_run pattern using artifacts, and warn against using pull_request_target to run untrusted builds.
  • Keeps the existing comment format and hidden marker; updates OpenSpec, tests, and dist/index.js.

• Migration

  • Remove comment-pr and github-token inputs from workflows.
  • After running the action, read the Markdown file and create/update the PR comment in a separate step.
  • For public forks, upload the Markdown in pull_request, then post from a trusted workflow_run with pull-requests: write.
  • Comparison job can run with contents: read only; grant write perms only in the comment workflow if needed.

^{Written for commit 2a70bd9. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

1 issue found across 25 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>