feat(fix): comment on PR with summary of what Claude tried

When the fix workflow runs on a Dependabot PR (whether it succeeds or hits the max-turns/budget limit), it should leave a comment on the PR summarizing what Claude attempted.

Why

An engineer picking up a PR where BLEnder failed should know:

• Which CI checks were failing
• What Claude tried to fix
• Whether it ran out of turns or hit another limit
• What files it changed (if any)

Without this, the engineer starts from scratch.

Implementation

After Claude exits in run-claude.sh, post a comment via the GitHub API with:

• The failing check names (already gathered by gather-context.sh)
• Claude exit code and reason (max-turns, budget, success)
• A git diff --stat of any changes Claude made
• Optionally, the last few lines of Claude output as context

The comment step needs GH_TOKEN, which is currently stripped from run-claude.sh for security. The comment should be posted in a separate workflow step after Claude finishes, using the app token that already exists in the workflow.

Approach (from #11)

• Add a system prompt instruction telling Claude to write a .blender-summary.md file
• Add Write to --allowedTools so Claude can create the file
• Add a fallback summary when Claude crashes before writing one
• Post the summary as a PR comment after Claude finishes (success or failure)
• Guard against nonce leaks in the summary file

Start by reading run-claude.sh, gather-context.sh, and the workflow that invokes them; trace how the app token and Claude exit status flow between steps. Done means the workflow comments on the Dependabot PR after both success and failure with checks, attempt outcome, diff stat, and a summary or fallback, while guarding against nonce leaks.