feat(ci): surface failing-job root cause in the PR failure comment

[joshua-temple]

Problem

The drift-comment.yaml companion reported only the workflow-drift job. When another gated job fails (for example Unit Tests, where the action-pins consistency-guard failures land), the PR showed a red gate with no inline explanation and a maintainer had to open the run logs.

Fix

Extend the single existing workflow_run companion (renamed display name to "PR Failure Report"; no second workflow, which would race and double-comment) to:

• Extract the failed job(s) and their root cause from the triggering run: check-run annotations first, then a bounded (~30-line) log tail, covering the first few failed jobs.
• Special-case the action-pins guard failure (TestWorkflowsConsistentWithActionPins / TestActionPinsAnchorCoversManifest): parse the want/got rows and print the exact internal/generate/action_pins.yaml edit so the reader gets the fix without opening logs.
• Backtick-fence every fork-supplied log/annotation string, sizing the fence longer than any backtick run in the content so untrusted text cannot break out.
• Add a head_sha guard so an out-of-order workflow_run completion for a superseded commit cannot overwrite a newer comment.
• Preserve fork-safe PR-number resolution, the tailored workflow-drift guidance, and the self-clear-on-green behavior.

Permissions stay permissions: {} top-level with job-level pull-requests: write + actions: read (needed to read the triggering run's jobs, annotations, and logs).

Verification

• actionlint clean on the changed workflow.
• Embedded github-script JS syntax-checked with node --check.
• go build ./... and go test ./internal/generate clean (no Go changed).

Closes#437