Syncs the workflow from lithoscomputer/code-review: the SARIF renderer,
the deterministic PR publisher (publish_pr.py plan/apply plus the opt-in
publish_pr graph node and post_pr inputs), the GitHub permissions grant
that has Fabro inject a scoped GITHUB_TOKEN, and a planted-bug probe
fixture so this refresh commit itself yields inline-postable findings
for the publisher's live acceptance run.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqM6MiUp32js5YrbiW777k