S0-CI-01: GitHub Actions Workflow for Comment-Only Slice

[ezeanyicollins]

Scope: Build CI workflow (patchpro.yml) that integrates Ruff, Semgrep, and the PatchPro agent.

Tasks:

• Create workflow triggered on pull_request.
• Steps: checkout → Ruff/Semgrep → PatchPro agent → sticky comment.
• Set minimal permissions (contents: read, pull-requests: write).
• Configure concurrency group (1 workflow per PR).
• Set timeout ≤ 5 min.

DoD: On any demo PR, CI posts a sticky comment with findings and diffs.