fix(ci): surface marker scan health and dangling claims

[mbeacom]

Summary

• render Inbound marker scan incomplete when changed files are absent, unreadable, outside the worktree, or skipped by the scan cap
• render Unresolved inbound markers when a completed scan finds dangling or cross-log marker claims
• cap unresolved examples at 10, safely escape PR-authored paths/messages, and keep changed-record validation errors first under the global comment budget
• document that the PR head checkout must remain at GITHUB_WORKSPACE

Both marker sections remain advisory and do not affect CheckOutcome.ok or the Action verdict. A deliberately truncated 8192-byte header read remains a successful scan and does not trigger the incomplete-scan notice.

Validation

• bun test
• bun run typecheck
• bun test packages/ci/test
• cd site && bun run build

Closes #126
Closes #112

[Copilot]

🟢 Approval recommended

The implementation is complete and well tested, with only a minor wording correction identified.

Pull request overview

Surfaces marker scan failures and unresolved inbound claims in advisory CI comments.

Changes:

• Adds bounded, escaped marker-health sections without affecting verdicts.
• Expands CI tests for scan states, safety, and comment budgets.
• Documents checkout requirements.

File summaries

File	Description
packages/ci/src/comment.ts	Renders marker advisories.
packages/ci/dist/index.js	Updates the committed Action bundle.
packages/ci/test/comment-render.test.ts	Tests rendering and safety.
packages/ci/test/action.test.ts	Tests end-to-end behavior.
README.md	Documents marker reporting and checkout.
site/src/content/docs/ci.mdx	Expands CI guidance.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Decisions governing this change

• 0011 — Host the canonical JSON Schema at its $id on adrkit.dev
  • via path: site/**
• 0016 — Require every check to be observed failing before it counts as coverage
  • via path: packages/*/test/**
• 0022 — Scan inbound markers in check and CI without giving them exit-code authority
  • via path: packages/ci/src/**
• 0026 — Identify the CI comment by the strongest author evidence the token allows
  • via path: packages/ci/src/comment.ts
  • via path: site/src/content/docs/ci.mdx
• 0030 — Keep extension surfaces that carry a dependency tree outside this repository
  • via path: packages/ci/**
• 0032 — Publish one lockstep OCI image after the coordinated release succeeds
  • via path: README.md
• 0033 — Select interactive graph presentation at the CLI boundary while preserving piped DOT
  • via path: site/src/content/docs/**

[mbeacom]

Superseded by #178, which carries the reviewed marker-reporting implementation, canonical Linux Bun 1.3.14 Action bundle, Markdown boundary fix, and complete CI evidence.