Publish a package based on a PR comment

Hello, loving pkg.pr.new so far! Has saved so much time fiddling already.

As discussed a bit via DM with @Aslemammad, I'm making an issue for the for-now pretty vague want I have of being able to publish a package based on my PRs, on other people's repos, even without them having pkg.pr.new installed.

Let's say I have a PR on someone else's repo that doesn't use pkg.pr.new (yet). Example: https://github.com/colinhacks/zod/pull/3646. It would be great to still be able to get an easy shareable npm install ... command so that people can kick the tires on my proposal in their downstream projects, even without any interaction from the maintainer.

Since the PR is using my fork under mmkal, rather than colinhacks, and I have the pkg.pr.new GitHub app installed, in theory it may be possible for me to have a kind of shadow repo with an action which:

1. Is triggered by an @ comment on GitHub
2. receives the pull request URL for the comment
3. uses the octokit API to get pull request metadata
4. uses a GitHub actions workflow (defined... somewhere) to clone the head ref on the pull-request-creator's fork (i.e. in the above example the owner is mmkal not colinhacks)
5. runs a build command specified in the comment?
6. runs npx pkg-pr-new publish
7. replies to the comment with the URL

So in the above example, all I'd need to do to get an installable version of zod with my new feature would be to leave a comment along the lines of:

@pkg-pr-new publish
build: yarn install && yarn build

Several parts of this might be tricky or impossible, including triggering via an @ comment on someone else's repo, figuring out where exactly to define this GitHub Actions workflow so that it has the necessary permissions, and also the best way to share a build command (like npm run build, but would vary by project) via a comment.

There would also be lots of repos with complex setups that this wouldn't work for, but that's probably fine to start with.

Also would need to be careful that it's only possible for mmkal to trigger an action in mmkal's GitHub org to make sure nothing unsafe happens.

But it feels like most of this should be possible? What do you think?

No files or tests are named. Start by evaluating the GitHub comment trigger and workflow permissions, then trace the proposed Octokit metadata lookup, fork head-ref checkout, build command, and npx pkg-pr-new publish entry point. Done should include a safe, shareable install URL posted back to the comment for supported repositories.