[Feature]: Surface diff-aware Semgrep findings as an advisory PR comment

Summary

Surface diff-aware Semgrep findings as an advisory PR comment, not only as SARIF in the Security tab.

Problem statement

ci-code-analysis.yml runs Semgrep diff-aware on every PR but only uploads SARIF to the GitHub Security tab, which contributors rarely open. Report-only findings the branch introduces effectively go unseen during review, blunting the value of the scan.

Proposed solution

Add a non-blocking step that posts (and updates in place) a PR comment summarizing the new Semgrep findings the branch introduces. Stays strictly report-only — no gating — consistent with FND-003 §6.4. Fork PRs run with a read-only token, so the comment step must degrade gracefully (skip, don't fail) as the SARIF upload already does.

Prior art

Hermes lint.yml posts an advisory ruff/ty diff comment (exit-zero, updates the same comment rather than stacking).

Acceptance criteria

• Advisory comment appears on PRs that introduce new Semgrep findings.
• Comment updates in place rather than stacking on re-runs.
• No-op (or removes the comment) when the branch introduces none.
• Degrades gracefully on fork PRs with a read-only token.

Related

Extends the diff-aware Semgrep work on the ci/semgrep-diff-aware-sarif branch.