ci: post the discipline sentinel report as a PR comment

[orieg]

What

Turns on the discipline action's comment: true input on the Discipline Sentinel job (.github/workflows/ci.yml).

Why

Reviewers currently see the sentinel verdict only in the job log / step summary. With comment: true, the full report is posted as one pull-request comment, edited on every run — the verdict lands on the thread automatically.

Changes

• comment: true on the sentinel step
• discipline job permissions: pull-requests: read → write (comment posting)
• persist-credentials: false on the job's checkout: the discipline action reads the forge through DISCIPLINE_FORGE_TOKEN (env), not git credentials, so the token is kept out of .git/config now the job can write (flagged by the v0.15+ ci-integrity checkout-persists-credentials finding — itself a new-gate catch from the ci: bump discipline action pins from v0.14.4 to v0.18.0 #218 bump)
• Fork behavior unchanged and safe: a fork's read-only token is reported, not failed

Validation

• Local v0.18.0 discipline check --base origin/main: PASS (27 gates, 0 errors, 0 warnings, 0 overrides)
• Workflow YAML parses

The ci-integrity checkout-persists-credentials finding this change initially tripped is resolved by the persist-credentials: false above; note the bump in #218 is what armed that finding.

[github-actions]

discipline: passed

Base main (origin/main) (merge base b22268e623) · 27 gate(s) passed · 2159 item(s) examined · 0 warning(s) · 0 override(s)

_{discipline explain <gate> prints what a gate checks and how a finding is lifted. This comment is updated on every run; the check's status is the verdict.}