TypeScript client endpoint audit fails on every fork PR: comment POST 403s with a read-only token

Fix already in progress: draft PR #4796. Filing this so the PR has an issue to link; not looking for someone to pick it up.

What happens

On a pull_request raised from a fork, the endpoint-audit check fails even when the audit itself passes. Example from #4775: https://github.com/OpenHands/software-agent-sdk/actions/runs/33341834102 — the audit step reports ✅ endpoint audit passed, then the Comment audit report on PR step throws:

RequestError [HttpError]: Resource not accessible by integration
  status: 403

Why

A fork pull_request runs with a read-only GITHUB_TOKEN, so the workflow's pull-requests: write permission cannot be honoured and the report's comment POST comes back 403. The step is if: always(), so that 403 fails the whole check on every fork PR regardless of what the audit found — which means the check currently gives fork contributors no signal at all, only noise.

Push events have no PR to comment on at all (context.issue.number is undefined), so the same step can't post there either; it just never tried because it was gated on github.event_name == 'pull_request'.

Suggested direction

Publish the rendered report to the job summary on every run (the one surface any token can write), and attempt the PR comment only when the run is a same-repo pull_request whose token can write one. No permission change and no move to pull_request_target — a same-repo run that still can't comment should keep failing loudly. This is what #4796 implements (a port of the same fix previously reviewed as OpenHands/typescript-client#367, which closed unmerged when that repo was archived and the client moved here).

Review the endpoint-audit workflow and draft PR #4796, using the fork run in #4775 as the reproduction. Confirm done when fork and push runs publish the audit report in the job summary, same-repository pull requests handle commenting according to token access, and a genuine same-repository comment failure remains visible.