Improve automated PR review feedback

[Birditch]

摘要 (Summary)

Improve the automated PR review experience so contributors receive immediate feedback and useful open-source contributions are not blocked by policy-only warnings.

SIGN 声明 (SIGN Declaration)

• SIGN: I certify that I have the right to submit this work and agree it is provided under this repository's license.

Details

• Post an in-progress comment before calling the AI, then update the same comment with the result or a visible failure state.
• Grant pull-request write permission required for bot comments.
• Recommend merging by default unless the diff contains a concrete, high-confidence correctness, security, CI, or release blocker.
• Treat sensitive-file changes from third-party contributors as maintainer-review warnings instead of automatic failures.
• Document the new behavior.

Root Cause

The reviewer waited until the AI call completed before attempting its first comment, and GitHub rejected that final comment with 403 Resource not accessible by integration. Separately, the PR gate treated any third-party change under sensitive paths as a hard failure without evaluating whether the change was acceptable.

Security Impact

• GitHub Actions behavior is intentionally modified and described above.
• Contributor code is still not checked out or executed by either pull_request_target workflow.

Verification

• git diff --check
• Extracted JavaScript from both workflows passes node --check -
• Only the two workflows and their automation documentation are changed