feat(action): render PR comment to file and expose path output

[TheRealAgentK]

Closes #37.

What

Renders the validation-results PR comment Markdown body to a file (${{ runner.temp }}/validation-comment.md) and exposes the path via a new comment_path action output. The existing Post PR comment step now reads from that file via marocchino's path: input instead of an inline message: block.

This is the tooling-repo half of the fix for fork PRs not getting validation-results comments. The follow-up consumer-repo PR in autohive-ai/autohive-integrations will set post_comment: 'false', upload the rendered file as an artifact, and add a workflow_run-triggered companion workflow that posts the comment from the base-repo context (where the GITHUB_TOKEN actually has pull-requests: write even for fork PRs).

Why

pull_request workflows triggered from forks always run with a read-only GITHUB_TOKEN regardless of the workflow's permissions: block (docs). So the existing inline comment step always 403s on fork PRs and the job conclusion goes ❌ even when all five validation checks passed. Concrete example: autohive-ai/autohive-integrations#293 (HubSpot tasks, opened from lohitya/autohive-integrations).

The standard fix is the two-workflow pattern, which needs the comment body to be available as a file (otherwise the consumer workflow has to duplicate the entire ~40-line template). Hence this change.

Files

• scripts/render_comment.py (new) — reads check outcomes / outputs from env vars and prints the Markdown body to stdout. Using env vars rather than ${{ steps.X.outputs }} YAML interpolation avoids escaping issues with multi-line tool output, embedded backticks, and EOF markers.
• action.yml:
  • Adds a Render comment markdown step (id: render) that runs the new script and writes to ${{ runner.temp }}/validation-comment.md.
  • Adds a comment_path output exposing that path.
  • Switches the existing Post PR comment step from inline message: to path: (reads from the same file).

Backward compatibility

Strictly additive:

• No existing inputs / outputs are removed or renamed.
• Default behaviour for post_comment: 'true' (same-repo PRs) is unchanged — the same marocchino/sticky-pull-request-comment@v2 step posts the same comment, just reading the body from a file instead of an inline string.
• Existing consumers pinned at @v2 continue to work without changes when the v2 tag is moved to the merge commit.

Verification

• python3 -c "import yaml; yaml.safe_load(open('action.yml'))" — YAML parses cleanly.
• render_comment.py smoke-tested locally with multi-line / embedded-EOF / backtick payloads — produces the expected Markdown.

Out of scope (follow-up PR in autohive-integrations)

• Setting post_comment: 'false' and uploading the rendered file as an artifact in validate-integration.yml.
• Adding validate-integration-comment.yml (the workflow_run companion that downloads the artifact and posts the comment from base-repo context).
• Retagging v2 after this PR merges.

[NinosMan]

LGTM 👍