fix(ci): make Docs AI Review workflow work for fork PRs (#3577)

## Summary

Fix two related issues in `.github/workflows/docs-ai-review.yml` so that
the Docs AI Review packet + advisory comment works for fork-originated
PRs (which is the common case in this repo).

- **Rerun on push when labeled.** The `pull_request` trigger previously
only listed the `labeled` action, so the workflow ran exactly once when
the `ai-review-docs` label was first applied and did not re-run when the
PR was updated with new commits. Add `synchronize` and `reopened` to the
types list, and gate those two actions on the `ai-review-docs` label
already being present on the PR.
- **Split the advisory comment into a `workflow_run` workflow.** Pull
requests from forks run `pull_request` workflows with a read-only
`GITHUB_TOKEN` regardless of declared `permissions:`, so the inline
comment step could never post on fork PRs and returned 403 on both the
GraphQL `addComment` mutation (via `gh pr comment`) and the REST
`issues/{n}/comments` endpoint. Following the standard GitHub pattern:
- `docs-ai-review.yml` (pull_request trigger) now only prepares the
packet and uploads it, together with a `pr-metadata.json` describing PR
number / head SHA / base SHA / trigger name.
- A new `docs-ai-review-comment.yml` (`workflow_run` trigger) downloads
the artifact from the completed run, parses the metadata, and upserts
the advisory comment via REST. Because `workflow_run` runs in the
base-repo context, its `GITHUB_TOKEN` honors `issues: write` even for
fork PRs.

The comment workflow does not check out or execute any code from the
fork — it only consumes the prebuilt packet and metadata JSON — so it
avoids the footgun usually associated with giving write permissions to
fork-triggered runs.

## Test plan

- [ ] After merge, open a fresh fork PR and add the `ai-review-docs`
label — confirm `Docs AI Review` runs (prepare packet + upload
artifact).
- [ ] Confirm `Docs AI Review Comment` fires via `workflow_run`
afterwards and upserts a comment with the packet metadata.
- [ ] Push a follow-up commit to the same PR — confirm `Docs AI Review`
reruns on `synchronize` because the label is still applied, and the
advisory comment is updated in place (PATCH path).
- [ ] Post `/review-docs` as a COLLABORATOR/MEMBER on a PR — confirm
`Docs AI Review` runs via `issue_comment` and the comment workflow
follows.
- [ ] Remove the label, push again — confirm `Docs AI Review` no longer
runs.