fix(ci): isolate protected fork validation

[ddurst-nvidia]

Pull Request

Why

• Protected fork validation must retain the original writer-authorized
  issue_comment context while App-backed check mutations remain isolated in
  protected caller jobs.

What changed

• Authorize the exact comment, pull-request head, base, and current
  protected-main policy in a checkout-free receiver.
• Create and finalize the Required CI check only in protected-automation
  jobs whose repository-scoped App token has Checks write and Contents read.
• Run all candidate work through a secretless local reusable workflow that
  retains the issue_comment event and has no environment, OIDC, write
  permission, cache action, or retained artifacts.
• Bind authorization and reconciliation to the exact caller workflow, run,
  attempt, actor, triggering actor, reusable job, comment, head, base, and
  policy commit.
• Preserve the protected validator and conditional Linux, macOS, and Windows
  candidate cargo xtask ci matrix.

Review guide

• Start with .github/workflows/pr-ci-command.yml and verify that App
  credentials exist only in the protected start and finalization jobs.
• Then review .github/workflows/pr-ci.yml as the unprivileged reusable
  candidate workflow.
• Finally review the reusable-call and reconciliation bindings in
  .github/scripts/protected_pr_ci.py and their negative regressions.

Compatibility impact

• None. Public Rust APIs, schemas, wire formats, MSRV, release behavior, and
  the /ok to test <head-sha> command are unchanged.

Dependency and licensing impact

• None. No dependency, Action identity, Action pin, license, package-content,
  or third-party-notice changes.

Related issue

• None.

Testing

• /tmp/yaml-sigil-tools/bin/actionlint -config-file .github/actionlint.yaml
• shuck check .github/scripts
• python3 -m py_compile .github/scripts/protected_pr_ci.py .github/scripts/test_protected_pr_ci.py
• python3 -m unittest discover -s .github/scripts -p 'test_protected_pr_ci.py'
  — 69 passed
• cargo xtask ci
• git diff --check
• Shared controller, controller tests, command workflow, reconciliation
  workflow, and commit-policy hashes matched their intended sibling files.

Checklist

• I confirmed this belongs in the Rust implementation repository and is
  not a language-neutral specification change better handled in
  yaml-sigil-spec.
• I confirmed this change does not bypass or conflict with the public API
  contract in
  yaml-sigil-traits; any required
  traits changes are already available or tracked as coordinated work.
• I have the right to submit this contribution, every commit is GitHub
  Verified, and every commit includes a Signed-off-by trailer that exactly
  matches its Git author.
• I understand and can explain this change.
• I updated documentation or tests where needed.
• I reviewed CONTRIBUTING.md and SECURITY.md.

[ddurst-nvidia]

/ok to test 87c5ed3

[ddurst-nvidia]

/ok to test 09e80c7