GitHub PR comment fetcher

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/gather-reviews.ts, the runtime uses gh api graphql to fetch a user-provided PR’s review threads, PR comments, and review bodies from GitHub and then ingests those outsider-authored comment/review texts into Markdown output.