ci(pr-title): post the title-lint comment on fork PRs via workflow_run

pull_request gives fork PRs a read-only token, so the sticky comment can't be
posted from pr-title.yml. Split the comment into pr-title-comment.yml
(workflow_run), which runs from the base branch with a write token and works for
forks. pr-title.yml stays the required check (runs on the PR branch, forks
included, no deadlock) and hands the lint result to the commenter via an
artifact. workflow_run only fires once this workflow is on the default branch, so
it activates for fork PRs after merge; the required check is unaffected.

.github/workflows/pr-title-comment.yml

@@ -0,0 +1,76 @@
+name: 📝 PR Title Comment
+
+# Posts / updates / deletes the PR-title lint sticky comment with a write token,
+# so it works on FORK PRs too (the pull_request-triggered pr-title.yml only has a
+# read-only token on forks). workflow_run runs from the base branch with the base
+# repo's token. This is comment-only — the required check stays pr-title.yml.
+on:
+  workflow_run:
+    workflows: ["📝 PR Title"]
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read # download the artifact from the triggering run
+  pull-requests: write # post/update/delete the sticky comment
+
+concurrency:
+  group: pr-title-comment-${{ github.event.workflow_run.id }}
+  cancel-in-progress: true
+
+jobs:
+  comment:
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-26.04
+    steps:
+      - name: ⬇️ Download lint result
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh run download "${{ github.event.workflow_run.id }}" \
+            --repo "${{ github.repository }}" \
+            --name pr-title-result \
+            --dir result
+
+      - name: 🔎 Read result
+        id: result
+        run: |
+          echo "number=$(cat result/number)" >> "$GITHUB_OUTPUT"
+          if [ -s result/error ]; then
+            echo "has_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_error=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 📥 Load error message
+        if: steps.result.outputs.has_error == 'true'
+        run: |
+          {
+            echo "LINT_ERROR<<PR_TITLE_ERR_EOF"
+            cat result/error
+            echo
+            echo "PR_TITLE_ERR_EOF"
+          } >> "$GITHUB_ENV"
+
+      - name: 💬 Post title error
+        if: steps.result.outputs.has_error == 'true'
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        with:
+          number: ${{ steps.result.outputs.number }}
+          header: pr-title-lint-error
+          message: |
+            Hey there and thank you for opening this pull request! 👋🏼
+            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/).
+
+            **Error details:**
+            ```
+            ${{ env.LINT_ERROR }}
+            ```
+
+      - name: 🧹 Clear title error
+        if: steps.result.outputs.has_error == 'false'
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        with:
+          number: ${{ steps.result.outputs.number }}
+          header: pr-title-lint-error
+          delete: true

.github/workflows/pr-title.yml

@@ -16,30 +16,27 @@ jobs:
   validate_pr_title:
     name: "📝 Validate PR Title"
     runs-on: ubuntu-26.04
-    permissions:
-      pull-requests: write
-      contents: read
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         id: lint_pr_title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
-        if: always() && (steps.lint_pr_title.outputs.error_message != null)
-        with:
-          header: pr-title-lint-error
-          message: |
-            Hey there and thank you for opening this pull request! 👋🏼
-            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/).
+      # Fork PRs only get a read-only GITHUB_TOKEN here, so the sticky comment
+      # is posted from the privileged pr-title-comment.yml (workflow_run). Hand
+      # off the result (PR number + lint error) as an artifact for it to read.
+      - if: always()
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          LINT_ERROR: ${{ steps.lint_pr_title.outputs.error_message }}
+        run: |
+          mkdir -p pr-title-result
+          printf '%s' "$PR_NUMBER" > pr-title-result/number
+          printf '%s' "$LINT_ERROR" > pr-title-result/error
 
-            **Error details:**
-            ```
-            ${{ steps.lint_pr_title.outputs.error_message }}
-            ```
-
-      - if: ${{ success() && steps.lint_pr_title.outputs.error_message == null }}
-        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+      - if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          header: pr-title-lint-error
-          delete: true
+          name: pr-title-result
+          path: pr-title-result/
+          retention-days: 1