workflows: keep stage snapshots out of job outputs (#24)

Publish only the structured summary, findings, and readiness fields across jobs while preserving full stage evidence in the existing review artifact. Cover the public output boundary to prevent GitHub secret scanning from suppressing it.

Generated with [Codex](https://github.com/openai)

Author: idy

.github/scripts/pr-review/run.mjs

@@ -734,7 +734,15 @@ try {
     outputTokens: totals.output_tokens,
   });
 
-  appendOutput("review", JSON.stringify(review));
+  // Cross-job outputs are inspected by GitHub's secret scanner. Keep the
+  // publication payload to the fields consumed by readiness and publication;
+  // the complete stage evidence remains in aggregate-result.json and the
+  // encrypted Actions artifact.
+  appendOutput("review", JSON.stringify({
+    summary: review.summary,
+    findings: review.findings,
+    readiness: review.readiness,
+  }));
   appendOutput("session_id", sessionId);
   appendOutput("generation_key", generation.key);
   appendOutput("usage_available", "true");

.github/scripts/pr-review/test.mjs

@@ -542,6 +542,19 @@ fs.writeFileSync(outputFile, JSON.stringify(
   assert.equal(completedLedger.generations.at(-1).status, "completed");
   assert.equal(completedLedger.generations.at(-1).aggregate.metrics.input_tokens, 100);
   const reviewOutputs = fs.readFileSync(reviewOutput, "utf8");
+  const reviewOutputLine = reviewOutputs
+    .split("\n")
+    .find((line) => line.startsWith("review="));
+  assert.ok(reviewOutputLine);
+  const publicReview = JSON.parse(reviewOutputLine.slice("review=".length));
+  assert.deepEqual(Object.keys(publicReview).sort(), [
+    "findings",
+    "readiness",
+    "summary",
+  ]);
+  assert.equal(publicReview.summary, "Fake code review complete.");
+  assert.deepEqual(publicReview.findings, []);
+  assert.equal(publicReview.readiness.verdict, "pass");
   assert.match(reviewOutputs, /^credits_available=true$/m);
   assert.match(reviewOutputs, /^estimated_credits=0\.044$/m);
   const usageOutput = reviewOutputs