ci: publish OTA bundles to denis (S3) + automatic per-PR previews

Rewire OTA publishing off the legacy ota1 box onto the S3-backed denis
service, in two places:

- Prod path (bundle-deploy-eas-update.yml): dual-write the exported bundle
  to denis via `denis publish` alongside the existing ota1 upload, under the
  identical `!includes-changes && !version-changed` gate. Assumes the
  main-only `denis-ci-publish` role via OIDC (id-token: write). Both paths
  must succeed; they are removed together once denis is the sole origin.

- Per-PR previews (pull-request-commit.yml): replace the `@github-actions ota`
  comment trigger (pull-request-comment.yml, deleted) with an automatic job
  that fires on pull_request. Gated to same-repo PRs
  (head.repo.full_name == github.repository) authored by a
  MEMBER/OWNER/COLLABORATOR, so a fork or external contributor can never run
  with the publish role or repo secrets in scope. Publishes to the
  `pull-request-<N>` channel under the PR-scoped `denis-ci-publish-pr` role,
  further narrowed by an inline session policy to `pr/<N>/*`.

- setup-denis composite action: mint a short-lived github-app token
  (contents:read on private tango), download + verify the pinned
  denis release binary, put it on PATH.

denis release tag is a single `DENIS_RELEASE_TAG` env per workflow.

ROAST_SKIP: pre-commit roast flags setup-denis verifying the binary against
a checksum from the same tango release (no independent digest anchor).
Reviewed and accepted: exploitation requires compromising the private tango
release itself, and the marginal integrity gain is not worth pinning a digest
that must be bumped on every denis roll.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/actions/setup-denis/action.yml

@@ -0,0 +1,50 @@
+---
+name: Setup denis CLI
+description: >
+  Download and verify the denis OTA publish binary from the (private)
+  bluesky-social/tango releases and put it on PATH. Uses a short-lived GitHub
+  App token scoped to contents:read on tango, since the default GITHUB_TOKEN
+  cannot read a private repo's releases.
+
+inputs:
+  release-tag:
+    description: denis release tag in bluesky-social/tango to download
+    required: true
+  app-id:
+    description: GitHub App ID for the token used to read tango releases
+    required: true
+  private-key:
+    description: GitHub App private key
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: 🔑 Mint tango read token
+      id: tango-token
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.private-key }}
+        repositories: tango
+        permission-contents: read
+
+    - name: ⬇️ Download and verify denis binary
+      shell: bash
+      env:
+        GH_TOKEN: ${{ steps.tango-token.outputs.token }}
+        RELEASE_TAG: ${{ inputs.release-tag }}
+      run: |
+        BIN_DIR="$RUNNER_TEMP/denis-bin"
+        mkdir -p "$BIN_DIR"
+        cd "$BIN_DIR"
+        gh release download "$RELEASE_TAG" \
+          --repo bluesky-social/tango \
+          --pattern denis-linux-amd64 \
+          --pattern denis-linux-amd64.sha256 \
+          --clobber
+        # Verify before making it executable / putting it on PATH.
+        sha256sum -c denis-linux-amd64.sha256
+        mv denis-linux-amd64 denis
+        chmod +x denis
+        echo "$BIN_DIR" >> "$GITHUB_PATH"