Generate and comment new playground link when a PR includes a changed form

[david-roper]

Form preview links for pull requests

Adds a GitHub Action that comments on every PR touching lib/forms/** with an
"Open in playground" link for each added or modified form, so reviewers can try
a form without checking it out.

How it works

• Runs on pull_request_target so the comment can be posted on PRs from forks.
  The workflow and script always come from the base branch; the PR's files
  are only ever read as data via git objects — never checked out, installed,
  or executed.
• A three-dot diff finds the forms changed by the PR, each form's text files are
  read straight from git objects, and a share link is generated for each.
• The comment is created once and updated in place on later pushes (matched by a
  hidden marker), so a PR never accumulates duplicate comments.

Link generation uses the official package

Share links are produced with @opendatacapture/playground-url — the same
library the playground itself uses to encode and decode share URLs — rather than
a hand-rolled lz-string implementation. This keeps us in lockstep with the
playground's format for free.

Because the package ships its importable entry as raw TypeScript (and relies on
a dependency it doesn't declare for external consumers), it can't be imported
from the plain-node CI script. Its supported standalone interface is its
compiled CLI, so the script materializes each form's files into a throwaway
directory (read as data, never executed) and invokes the CLI to get the link.

Note: links now carry their payload in the URL hash fragment
(#files=…) instead of the query string. This is the package's current format —
it keeps the payload off the server (avoids HTTP 431 on large instruments),
and the playground still reads the old query-string format, so links shared
before this change keep working.

Changes

• .github/workflows/form-preview-links.yml — the workflow.
• .github/scripts/form-preview-links.js — builds the comment; encodes links
  via @opendatacapture/playground-url.
• package.json / pnpm-lock.yaml — drop the direct lz-string dependency,
  add @opendatacapture/playground-url (which pulls in lz-string
  transitively).

⚠️ Activation: must merge to the default branch

pull_request_target workflows only trigger from the version of the workflow on
the repository's default branch (main). This action therefore does nothing
until this PR is merged — after which it fires automatically on every future PR
that touches lib/forms/**. (This is GitHub's security model: the privileged,
write-token workflow is trusted only from the default branch, so a PR can't
introduce or alter it.)

Verification

• pnpm install --frozen-lockfile --ignore-scripts passes (CI parity) and
  tsc is clean.
• Ran the script end-to-end against a real form-changing commit locally — emits
  a valid playground link.
• Exercised the whole workflow in a live Actions run on a same-repo test PR
  (via a temporary pull_request trigger, not included here): the bot posted
  the comment and the generated link opened the form in the playground.

🤖 Generated with Claude Code

Closes issue #46