Decouple Pa11y PR commenting from forked pull_request token permissions

[Copilot]

Fork-origin PRs were failing in CI because the accessibility job tried to post issue comments using the pull_request token, which is read-only for forks. This change keeps accessibility checks in CI and moves fork comment publishing to a privileged, safe follow-up workflow driven by CI artifacts.

• Main CI behavior (unchanged intent, explicit boundary)

  • Keeps Pa11y execution and report generation in ci.yml
  • Continues uploading pa11y-report as an artifact
  • Leaves PR comment step gated to non-fork PRs only

• New fork-safe comment workflow

  • Adds comment-pa11y-report.yml triggered by workflow_run on completed CI
  • Runs only for fork-origin PR runs and only when a PR context exists
  • Uses repository-scoped permissions (issues: write) without checking out PR code
  • Downloads the Pa11y artifact from the CI run and creates/updates the marker-based PR comment (<!-- pa11y-report -->)

• Hardening and operability

  • Validates PR number before API calls
  • Handles artifact/report absence with explicit warnings (distinguishes download failure vs missing upload)
  • Handles report file read failures explicitly

on:
  workflow_run:
    workflows: ['CI']
    types: [completed]

jobs:
  comment:
    if: >
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.head_repository.fork &&
      github.event.workflow_run.pull_requests[0] != null

[github-actions]

Pa11y Accessibility Report

✅ All pages passed — 0 warning(s) (WCAG2AA)

---

Homepage

✅ No issues found.

---

Event

✅ No issues found.

---

Project

✅ No issues found.

---

Person

✅ No issues found.

---

Organization

✅ No issues found.

---

Venue

✅ No issues found.

---

Resource

✅ No issues found.

---

Tag

✅ No issues found.

---

Category

✅ No issues found.