fix(ci): post gate scorecard from base context for fork prs

[yuvrxj-afk]

Description

The wiza rehearsal (#427, first real fork PR through the pipeline) exposed that pull_request workflows get a read-only GITHUB_TOKEN on fork PRs regardless of the permissions block — the gate crashed trying to post its scorecard, failing the required check for reasons unrelated to PR quality. Every contributor plugin PR hits this today.

• Gate job now degrades gracefully: posting failures log a notice + print the scorecard to the job log; the exit code still enforces the required check (works on forks).
• The review-loop triage (base context, write token on any PR) now owns the scorecard comment and gate:failed label, refreshed on every Greptile review.
• Scorecard renderer moved to the pure module (gate.ts) and shared, since gate-main.ts is a side-effecting script that must not be imported.

Checklist

• I have run pnpm lint and all checks pass
• I have run pnpm typecheck and there are no TypeScript errors
• I have run pnpm build and all packages build successfully
• I have run pnpm test and all tests pass
• I have added or updated tests where applicable
• I have added or updated necessary documentation

Screenshots / Demos (if applicable)

Failing evidence: run 29023571261 on #427.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
www	Ready	Preview, Comment	Jul 9, 2026 2:29pm

[greptile-apps]

Greptile Summary

This PR moves fork PR scorecard posting into the base-context review loop. The main changes are:

• Adds an issue_comment trigger for Greptile review updates.
• Shares scorecard rendering from the pure gate module.
• Lets the gate job log the scorecard when posting is not allowed.
• Adds a dedicated typecheck for review scripts.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/workflows/plugin-pr-review-loop.yml	Adds base-context issue-comment handling and passes normalized PR metadata between jobs.
.github/workflows/pr-checks.yml	Adds a review-script typecheck after dependencies are installed.
scripts/pr-review/gate-main.ts	Uses the shared scorecard renderer and falls back to log output when posting fails.
scripts/pr-review/gate.ts	Exports the shared scorecard renderer for both gate and loop entrypoints.
scripts/pr-review/loop-main.ts	Normalizes issue-comment events to a full PR object and posts the scorecard from the loop.
scripts/pr-review/tsconfig.json	Adds an independent strict TypeScript config for the review scripts.

_{Reviews (9): Last reviewed commit: "fix(ci): standalone tsconfig for review ..." | Re-trigger Greptile}

[yuvrxj-afk]

@greptileai re-review — correct catch: renderScorecard was used without being imported (edit rounds clobbered the import line, and nothing typechecks scripts/). Fixed the import, and closed the blind spot: scripts/pr-review now has its own tsconfig and a typecheck step in the gate job, which immediately surfaced and fixed three more strictness gaps.