ci: centralize Trust advisory comments

[briananderson1222]

Summary

Adds a thin trust-advisory-comment job to the existing Trust Verify workflow. The Trust action is pinned to 90b260996e1c4477c56317935f0362d48a8cf8d5 and exports a structured failure-summary; the central reusable publisher is pinned to e6dfe1bea874266a98059c682c21a6b73ae9c71e.

Behavior and security boundary

• For same-repository pull requests, the reusable workflow posts or updates the advisory Trust comment using the Trust Verify result and run URL.
• A failed Trust Verify run supplies its structured failure summary to the central workflow, which renders it inside a collapsed details block.
• Fork pull requests remain check-only: the same-repository guard skips the write-capable job.
• The existing trust-verify job and its contents: read permission remain unchanged. The added reusable job receives only pull-requests: write.
• The guard binds the publisher to a pull-request event and github.event.pull_request.head.repo.full_name == github.repository; it is not a workflow_run publisher.

Verification

• YAML parsed successfully.
• Confirmed both immutable pins, the Trust job output-to-reusable-job details chain, check-name: Trust Verify, the same-repository fork guard, and no workflow_run trigger.
• git diff --check passed.
• Repository pre-push verification runs normally on publication.

Rollout state

Trust Verify and its central advisory comment remain advisory and non-required during Observe mode. This depends on kontourai/flow-agents#1120 and kontourai/.github#12.

No merge is requested by this draft.

[github-actions]

Trust Verify needs attention

Trust Verify completed with result: failure.

Open the workflow run

Failure details

[bundle-required-no-declared-marker] delivery/DECLARED marker present but out of scope for this change — STALE-SCOPE SUSPECTED: 6 of 8 well-formed entries PARTIALLY matched (some conditions matched, at least one did not). An exemption covering this change plausibly exists and a condition has drifted — e.g. a rotated bot actor (#1011) — rather than this change having no exemption at all. Per-entry breakdown below.

This is advisory and non-blocking; it does not change the Trust Verify verdict or merge requirements.