ci: post validation comment via workflow_run to fix fork PRs

[anistark]

The "Validate plugin submission" workflow runs its checks and posts the result comment from the same job. On pull requests from forks, GitHub forces GITHUB_TOKEN to read-only regardless of the workflow's permissions: block, so issues.createComment returned 403 "Resource not accessible by integration" and the job failed — even though every validation check passed. This broke the run on every external contributor's PR (e.g. #29, #30).

Split comment posting out of the validation job:

• validate-plugin.yml now runs read-only (contents: read). Instead of commenting, it renders the comment body and PR number to a pr-comment artifact. Step outputs are passed via env vars rather than interpolated into the script, and the literal \n sequences the shell steps emit are converted to real newlines.
• comment-on-pr.yml is a new workflow_run workflow that fires when validation completes. It runs in the base-repo context with a writable token, downloads the artifact, and creates or updates the comment. Because it only reads an artifact and never checks out or runs PR code, granting it write permissions is safe.

Note: workflow_run only takes effect from the default branch, so this fix activates after merge to main; the validation workflow must re-run on a PR afterward to produce the comment.

Summary

Type of change

• Add a plugin → please use the add-plugin template instead
• Update a plugin → please use the update-plugin template instead
• Remove a plugin → please use the remove-plugin template instead
• Marketplace / registry change (schema, validation, plugins/ tooling)
• Site / docs change (landing page, README, content)
• CI / workflow / repo tooling
• Bug fix
• Other

Checklist

Uncheck any item that does not apply or has not been completed.

• I have read and understood the contributing guidelines
• Changes are scoped and focused on a single concern
• Tested locally where applicable
• Updated relevant docs (README, site content, etc.) if behavior changed
• Did not hand-edit marketplace.json (it is generated)