ci: comment on PR workflow drift via fork-safe workflow_run

[joshua-temple]

Problem: the workflow-drift job in pr.yaml runs on pull_request. For fork PRs that token is read-only with no secrets, so it cannot post a PR comment explaining the drift and the fix.

Fix: keep workflow-drift failing the required PR Gate on drift (the gate is not weakened), but also have it capture the verify output, exit code, and PR number into a drift-result artifact (uploadable with the read-only fork token). A new drift-comment.yaml runs on workflow_run completion in the base-repo context, where it has a write token. It downloads the artifact (data only), reads the PR number and result, and posts/updates a sticky comment (marker <!-- cascade-drift-check -->): the drift report plus remediation when drifted, a short resolved note when a prior comment is cleared, and nothing on already-clean PRs.

Security boundary: the privileged workflow_run job never runs actions/checkout on the PR head and never executes any PR code. It only downloads an artifact and calls the issues API. The write token lives only in the base context, not in the pull_request workflow. Both sides use least-privilege permissions (workflow-drift: contents: read; comment job: pull-requests: write, actions: read; top-level permissions: {}). The PR number travels in the artifact because it is not reliably available to workflow_run for forks.

Verification: actionlint clean on both files; go build ./... clean; exit-code path traced (non-zero verify -> job fails -> PR Gate red; zero -> job succeeds). All actions pinned by SHA.