feat(herald): add the Lore decisions-on-PR capability [roadmap:decisions-on-pr]

[tcballard]

Delivers the Herald capability — the decisions-on-PR advisory comment — implementing the pr-decision-surfacing design and the decisions-on-pr roadmap in the rac-core corpus. Epic: itsthelore/rac-core#351.

What it does

herald/github/action.yml is a composite action, consumed as uses: itsthelore/rac-ci/herald/github@<ref>, that:

• computes the PR's changed paths from the merge base (triple-dot diff, fetch-depth: 0 required, like Watchkeeper);
• runs rac decisions-for --json per changed path — the engine's live-decisions lookup (decision-to-code-proximity) — and merges the results by decision id via herald/github/render.py;
• posts ONE advisory comment (id, title, matched scope, changed paths), found by its marker and updated in place on re-runs. No comment when nothing governs; an existing comment updates even to the empty state so it never goes stale.

Posture

• Facts, never verdicts (ADR-034/067): the comment names what governs and recommends review; it never gates the merge. The action succeeds whatever it finds — only operational breakage fails the step, and a read-only token (forks) degrades to the step summary.
• Thin client (ADR-063): matching and liveness live entirely in the engine; the wrapper only joins, sorts, and formats. No wall-clock input — the same corpus and diff render the same bytes.
• Follows the repo's capability × platform layout alongside watchkeeper/gatekeeper/registrar; README capability table updated.

Tests

• tests/test_herald_action.py — structural contract tests in the house style: composite wiring, exact input set, triple-dot diff, renderer hand-off, and the never-gate comment step.
• tests/test_herald_renderer.py — behavioral battery against the published engine: sorted/deduplicated rendering with scope and link assertions, the empty state, survivability of a bad changed path, the <details> overflow at max-inline, and byte-determinism under reversed input order.
• .github/workflows/tests.yml — the structural job now excludes the behavioral file; a new herald-renderer job installs the published rac-core and runs the battery, keeping the structural tier engine-free.

Full suite: 23 passed.