Report the scan delta on the pull request and job summary

[satsura]

Until now the only place a reader could see what a scan found was the raw CI log. Every run now renders a markdown report — new findings with severity, file:line and a link to the task each one created — and publishes it:

• Job summary (always, no token) — rendered on the run's page.
• Pull-request comment when the run belongs to one, replacing its own previous comment via a hidden marker so a thread of stale reports never builds up. Needs pull-requests: write; without it the report simply stays in the summary.

The report is published before the gate exits, because a failed gate is exactly when the detail is needed. A baseline scan is framed as such — findings recorded, no work created, nothing gated.

Pairs with startmatter/k#337, which adds taskKey (SID/T/12) and taskUrl to the ingest response so the report can link to the work rather than print an opaque id.