feat(ci): link ADRs and collapse long lists in the PR comment

[mbeacom]

What and why

The governing-decisions comment named records as bare bold ids and rendered every list in full. On a change touching a busy part of the tree, that was a wall of bullets with nothing to click. This makes the comment navigable and keeps it readable when many records apply.

• Links. Every record id links to the record at the evaluated commit (GITHUB_SHA), including the successor in "superseded by". Each @adr declaration links to its line. A backslash in a path is kept as a filename character (%5C), never treated as a separator. URLs are absolute and built from context.serverUrl, because comment bodies never resolve relative links and GHES has to link to itself.
• Untrusted paths. Record filenames and declaration paths come from the PR. Each segment is percent-encoded, including the ()'!*~ that encodeURIComponent leaves alone. A path that is absolute, contains ./../empty segments, or holds a control character gets no link.
• Tally. A line under the heading gives the accepted count, e.g. **10** accepted decisions govern this change · 1 historical record. It's omitted at zero, where it would only repeat the "no accepted decisions" sentence.
• Collapsing. Up to 10 governing decisions stay expanded; 11 or more collapse behind a summary carrying the count. Active proposals and historical records are always collapsed, since neither binds the change.
• Truncation. A body over GitHub's limit now has every open <details> closed at the cut, with the closers budgeted up front. Without that, GitHub folds the "output truncated" notice into the collapsed block.

Unchanged: the marker still leads the body (ADR-0026), every display cap still applies, markers still have no exit-code authority (ADR-0022), and @adrkit/core is untouched. No new action.yml inputs.

Checklist

• Commits are DCO signed off (git commit -s).
• If this changes a recorded decision in docs/adr/, an ADR is added or supersedes the affected record. (No recorded decision changes; this is presentation inside ADR-0022/0026.)
• If the schema changed, I edited the Zod source and re-emitted. (Schema unchanged.)
• I regenerated packages/ci/dist under linux/amd64 bun 1.4.2 and committed it. Only index.js changed; queue-action.js is byte-identical.
• New or changed behavior is covered by tests, and each was observed failing before it passed. I disabled the <details> closers and the path guard in turn and watched their tests fail.
• bun run typecheck && bun run build && bun test && bun run lint pass (3214 tests).

Notes for reviewers

Three defaults worth pushing back on:

1. Links point at GITHUB_SHA, the merge commit the default checkout lints, because that's the tree record paths and marker lines are read from. A head-SHA link would 404 for a record the base added after branching, and a base change above a marker would shift its #L anchor (caught in review). The merge commit is regenerated when the base moves, but the comment is rewritten on every run.
2. Expand up to 10 governing decisions.
3. Proposals and history always collapsed.

I haven't seen the result rendered on a live PR yet. This PR's own action-dogfood run is the first look at how GitHub displays the <details> blocks and links. Both dogfood workflows assert only on the marker, so moving the old #### headings into <summary> doesn't affect them.

[Copilot]

Copilot review overview

🟡 Changes recommended

Links can target incorrect files or revisions, and rename tallies overcount changed files.

Review effort: Balanced
Findings: 3

Open (3)

• Preserve backslashes in Git paths when generating links · New
• Count original changed files instead of expanded rename paths · New
• Use evaluated checkout SHA for generated file and line links · New

What changed in this PR

Adds navigable, collapsible governing-decision comments with tallies and safe truncation.

Changes:

• Links ADRs and marker declarations.
• Collapses long or non-governing sections.
• Regenerates the Action bundle and expands tests.

The adrkit MCP server was unavailable, so marker-only governance was not independently verified.

File	Description
packages/​ci/​src/​comment.ts	Adds links, tallies, collapsing, and truncation handling.
packages/​ci/​src/​action.ts	Supplies record paths to the renderer.
packages/​ci/​src/​index.ts	Configures repository and commit links.
packages/​ci/​test/​comment-render.test.ts	Tests rendering behavior.
packages/​ci/​test/​action.test.ts	Tests Action link integration.
packages/​ci/​dist/​index.js	Regenerates the shipped Action bundle.
CHANGELOG.md	Documents the feature.

[github-actions]

Decisions governing this change

7 accepted decisions govern this change

• 0016 — Require every check to be observed failing before it counts as coverage
  • via path: packages/*/test/**
• 0022 — Scan inbound markers in check and CI without giving them exit-code authority
  • via path: packages/ci/src/**
• 0026 — Identify the CI comment by the strongest author evidence the token allows
  • via path: packages/ci/src/comment.ts
  • via path: packages/ci/src/index.ts
• 0030 — Keep extension surfaces that carry a dependency tree outside this repository
  • via path: packages/ci/**
• 0035 — Execute the gates that certify a pull request from the default branch
  • via path: packages/ci/**
• 0036 — Expose the governing-decisions Action through one root Marketplace entry point
  • via path: packages/ci/dist/index.js
• 0041 — Regenerate committed artifacts on Dependabot pull requests with default-branch scripts behind a maintainer label
  • via path: packages/ci/dist/**

_{Links point at f4ccdd7, this run's GITHUB_SHA. Run adr explain <path> locally to see why a file is governed.}