fix(checks): CI rules fired on YAML comments; tighten pull_request_target to the real trigger

[bkd-dotcom]

The bug

Every rule in scan_ci_permissions matches raw added text, with no comment handling. So a workflow that documents a risk trips the rule that exists to catch it.

This was found in the field, not in theory. Signetry/core#92 — a PR whose entire purpose was to avoid pull_request_target — was returned 🔴 Block, with two findings pointing at:

# We deliberately do NOT use `pull_request_target`: that runs with a writable
#     here safe, unlike `pull_request_target` + checkout of PR head.

Both are comments. The reviewer blocked a PR for explaining why it doesn't do the dangerous thing.

The same hole applied to every other rule in the function — permissions: write-all, id-token: write, curl … | sh, and uses: pinning all fired from prose.

The fix

1. Skip whole-line YAML comments. Inline trailing comments are deliberately still scanned: # is legal inside a quoted scalar, so stripping trailing comments by regex risks hiding real configuration. Documented in the code.

2. ci.pull_request_target now matches the trigger, not the string — in every form YAML permits:

form	caught
pull_request_target: (mapping key)	✅
on: pull_request_target (scalar)	✅
on: [push, pull_request_target] (inline sequence)	✅
- pull_request_target (block sequence item)	✅

Worth noting: the pre-existing test only covered the on: pull_request_target scalar. My first pass matched the mapping key only — running the existing suite caught that it would have silently regressed the scalar form. That's now pinned by a test over all four shapes.

Verification

25 tests pass (23 existing + 2 new), ruff clean. The new tests assert:

• all four trigger forms still block
• the five comment shapes that previously produced findings now produce none, using the two core#92 lines verbatim

Follow-up needed to land this in the field

Signetry/core's workflow pins signetry-reviewer @ git+…@v0.1.2, so this fix has no effect there until a new tag is cut and the pin is bumped. I've left the release itself to you rather than tagging unilaterally — say the word and I'll cut v0.1.3 and open the pin bumps across the repos that install the reviewer.