docs: slim fork-PR SonarCloud wrapper comments

Move the detailed explanation to the reusable workflows in actions-common and
keep the refit wrappers to short pointers.

Author: glennawatson

.github/workflows/ci-build.yml

@@ -20,9 +20,7 @@ jobs:
         secrets:
             CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-    # Fork PRs cannot run SonarCloud directly (no access to SONAR_TOKEN). Record
-    # the PR number + base branch so the trusted, workflow_run-triggered
-    # SonarCloud (fork PRs) workflow can decorate the correct pull request.
+    # PR metadata consumed by the fork-PR SonarCloud flow (see sonarcloud-fork.yml).
     save-pr-metadata:
         if: github.event_name == 'pull_request'
         runs-on: ubuntu-latest

.github/workflows/sonarcloud-fork.yml

@@ -1,10 +1,7 @@
 name: SonarCloud (fork PRs)
 
-# Runs SonarCloud analysis for pull requests opened from forks, which cannot run
-# the standard SonarCloud workflow because fork PRs have no access to
-# SONAR_TOKEN. Triggered by `workflow_run` once the untrusted "Build" workflow
-# finishes, so this runs in the base repo's trusted context (token available).
-# See the SECURITY note in workflow-common-sonarcloud-fork.yml.
+# SonarCloud analysis for fork PRs. See workflow-common-sonarcloud-fork.yml in
+# reactiveui/actions-common for how and why this works.
 
 on:
     workflow_run:
@@ -17,8 +14,7 @@ permissions:
 
 jobs:
     sonarcloud-fork:
-        # Only for fork PR builds that succeeded. Same-repo PRs are already
-        # analysed by sonarcloud.yml, so they are excluded here.
+        # Only successful fork-PR builds (same-repo PRs use sonarcloud.yml).
         if: >-
             github.event.workflow_run.event == 'pull_request' &&
             github.event.workflow_run.conclusion == 'success' &&