fix: slices-comment creates the PR comment via REST — the write-token job has no git context

The token/exec split gives slices-comment NO checkout by design, and gh's
pr-comment subcommand resolves the repo FROM git — it died with 'not a git
repository' on PR #2746's first run (the update-existing PATCH path was
already explicit-repo REST and worked). Create now posts through
gh api repos/.../issues/N/comments, and the wiring test pins that no
git-context-requiring comment call can creep back into the job.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/evals.yml

@@ -413,5 +413,9 @@ jobs:
             gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
               -X PATCH -f body="$BODY"
           else
-            gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY"
+            # REST, not gh's pr-comment subcommand: this job runs with NO
+            # checkout (the token/exec split), and that subcommand resolves
+            # the repo FROM git — it dies with "not a git repository" here.
+            gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
+              -X POST -f body="$BODY"
           fi

test/evals-workflow-wiring.test.ts

@@ -111,6 +111,10 @@ describe('evals.yml sliced-lane wiring (post-matrix)', () => {
     expect(commentJob).not.toContain('bun install');
     expect(commentJob).not.toMatch(/run: .*bun run/);
     expect(commentJob).not.toContain('uses: ./');
+    // No checkout also means no git context: `gh pr comment` resolves the
+    // repo FROM git and dies with "not a git repository" here (PR #2746's
+    // first run). Every comment call must be explicit-repo REST (gh api).
+    expect(commentJob).not.toContain('gh pr comment');
     // And the code-executing report job must NOT hold write scopes.
     const reportJob = evalsYml.slice(evalsYml.indexOf('  slices-report:'), evalsYml.indexOf('  slices-comment:'));
     expect(reportJob).not.toMatch(/pull-requests: write/);