ci: announce raised + merged pull requests to Discord

[swstegall]

Adds .github/workflows/announce-pull-request.yml — a port of the Garlemald-Server PR announcer — which posts to the PR-announcements Discord channel when a PR is raised (opened/reopened) and when a PR is merged.

Message format

@<maintainer role>, Pull Request raised for Garlemald Client.
Title: <pr title>
Source Branch: <user>:<branch>
Destination Branch: <user>:<branch>
<pr url>

…and the same with merged on a merged close. (Closed-without-merge PRs are not announced.)

Design / hardening

• Trigger pull_request_target (not pull_request): contributors work from forks, and pull_request fork runs have no secrets and need first-time-contributor approval, so the announcement would silently never fire. pull_request_target runs in the base-repo context (has the secret, no approval gate). Safety: never checks out or runs PR code — only reads event metadata and POSTs to Discord.
• Webhook via the DISCORD_PR_WEBHOOK_URL repo secret (already set), never hardcoded — a public webhook URL gets auto-revoked by Discord's scanner.
• No raw JSON interpolation (payload built with jq -n --arg) and no literal ${{ }} inside the run: block — the two bugs that previously broke add_issues_to_project.yml. All dynamic values arrive via env:.
• allowed_mentions: {parse: [], roles: [<maintainer>]} so an attacker-controlled PR title (e.g. containing @everyone) can only ever ping the one maintainer role.
• permissions: {} (the GITHUB_TOKEN is unused); a Discord failure is non-fatal.

Validation

• diff against the Garlemald-Server workflow: the only difference is the project name ("Server" → "Client").
• yaml.safe_load parses; ${{ appears only in concurrency:/env: positions (zero in the run: block); hostile-title payload → valid JSON with inert mentions; actionlint clean.

Maintainer role id 1510751664347283556 (same as the Garlemald-Server PR announcer), defined once as a workflow-level env. Because pull_request_target keys off the base branch's copy, this takes effect for PRs targeting develop once merged (and main after the next develop → main); it won't fire on this PR itself.

🤖 Generated with Claude Code