fix(ci): prepare on GitHub-hosted ubuntu + PR comment on skip

Two more Copilot findings on b0fdd07:

1. line 35 — defense in depth: prepare on self-hosted is risky.

   Even though the prepare job doesn't execute fork code (it only does
   git diff / git show / file reads — never pip install, npm install,
   build, or tests), Copilot's right that running fork content on a
   self-hosted runner with internal-network access is the wrong
   default. A future maintainer who innocently adds a "run linter"
   step to prepare could turn it into an attack vector against the
   VyOS internal network or a persistence mechanism on the host.

   Moved prepare to runs-on: ubuntu-latest. GitHub-hosted runners are
   ephemeral, isolated, and have no path to internal services. The
   trusted validate job stays on [self-hosted, web]; the split-job
   artifact bridges the trust boundary as before.

   Side benefit: removes the runner-side dependency on jq/gh/git
   for the prepare job (those are pre-installed on ubuntu-latest).

2. line 149 — skip-notice discoverability.

   When secrets are missing the workflow only emits ::notice:: in
   the run logs. Contributors checking the PR timeline have no
   reason to click through to the run page. Added a new step that
   posts an actual PR comment via gh pr comment when skip=true,
   running with GH_TOKEN: ${{ github.token }} (the validate job
   already has pull-requests: write).

   The ::notice:: annotation is preserved alongside.

🤖 Generated by [robots](https://vyos.io)

0 files changed, 0 insertions, 0 deletions