review-code: post sticky PR comment as part of the run (absorb post-review-findings.mjs)

[mabry1985]

Why

Every repo using `review-code` follows the same pattern:

1. `review-code init`
2. `review-code map`
3. `review-code run --all`
4. `review-code report --output /tmp/review.md`
5. Local script that takes `/tmp/review.md` and posts it as a sticky PR comment via `gh api`

Step 5 is currently a copy-pasted `scripts/post-review-findings.mjs` (~86 LOC) in each consumer repo. Same drift risk as the release-notes script before it was centralized.

What

Either:

Option A (preferred): Add a `review-code post` subcommand that takes the report markdown + a PR number + a GH token and posts a sticky comment. Consumers replace their local script with one line:

- run: npx --yes -p github:protoLabsAI/release-tools review-code post \
    --pr ${{ github.event.pull_request.number }} \
    --report /tmp/review.md \
    --findings ${{ steps.review.outputs.findings }}
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Option B: Expose the full `init → map → run → report → post` chain as a reusable workflow (`workflow_call`). Drops the consumer's workflow to ~5 lines.

# .github/workflows/code-review.yml
name: Code Review
on: [pull_request]
jobs:
  review:
    uses: protoLabsAI/release-tools/.github/workflows/review-code.yml@v1
    secrets:
      GATEWAY_API_KEY: ${{ secrets.GATEWAY_API_KEY }}
      GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}

Option B subsumes Option A and is the cleaner end state.

Reference

The local script being absorbed: scripts/post-review-findings.mjs.

Filed off the back of protoMaker#3650.