Remind LeanCode members to double-check public vs internal on PRs

Comments once on newly opened PRs whose author is a LeanCode org member
(author_association MEMBER/OWNER), asking whether the change is meant
for the public marketplace or for ai-plugins-internal. Uses
pull_request_target so it can comment on fork PRs too; safe since the
job never checks out PR code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wzslr321

.github/workflows/internal-contribution-reminder.yml

@@ -0,0 +1,35 @@
+name: Internal contribution reminder
+
+# Asks LeanCode organization members whether their PR is intentionally public.
+# Everything merged here becomes publicly visible and is synced into
+# ai-plugins-internal, so internal-only content must not land in this repo.
+#
+# pull_request_target is safe here: the job never checks out or executes PR
+# code — it only reads the event payload and posts a comment.
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  remind:
+    if: contains(fromJSON('["MEMBER", "OWNER"]'), github.event.pull_request.author_association)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment with public-vs-internal reminder
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          gh pr comment "$PR_URL" --body "Hi @${AUTHOR}! :wave: You're a LeanCode member, so a quick sanity check before this ships: **is this PR meant for the public marketplace?**
+
+          Everything merged here becomes publicly visible and is automatically synced into \`ai-plugins-internal\`.
+
+          - Internal-only content (client-specific guidance, internal processes, backend/PMO plugins, anything not ready to be public) belongs in [ai-plugins-internal](https://github.com/leancodepl/ai-plugins-internal) instead.
+          - Generally useful, public-ready content is right at home here — the internal repo will pick it up through the sync.
+
+          If public is what you intended, just ignore this comment. :slightly_smiling_face:"