ci(vu1nz-scan): don't fail the scan when the PR comment can't be posted

Dependabot PRs run with a read-only GITHUB_TOKEN, and GitHub was returning
503 (the HTML "Unicorn" page) for the comment write; the step's catch only
handled 403 and re-threw everything else, failing the whole scan even though
the security scan itself passed.

- skip the comment step for github.actor == 'dependabot[bot]'
- continue-on-error: true
- warn-and-continue on any status instead of only 403

Mirrors sh1pt pack vu1nz-scan@1.0.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/vu1nz-scan.yml

@@ -166,7 +166,12 @@ jobs:
           fi
 
       - name: Comment on PR
-        if: always() && github.event.pull_request.head.repo.full_name == github.repository
+        # Best-effort only. Skip for Dependabot (read-only token can't comment)
+        # and never fail the job if posting the comment errors — the scan's
+        # pass/fail is decided by the "Build PR comment" step, and findings are
+        # always written to the job summary.
+        if: always() && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        continue-on-error: true
         uses: actions/github-script@v9
         with:
           script: |
@@ -206,9 +211,9 @@ jobs:
                 });
               }
             } catch (err) {
-              if (err.status === 403) {
+              // Posting the comment is best-effort. Read-only tokens return 403
-                core.warning(`Cannot post PR comment (read-only token): ${err.message}. Findings are in the job summary.`);
+              // and transient GitHub outages return 503 (the "Unicorn" HTML
-              } else {
+              // page); neither should fail the scan. Findings are in the job
-                throw err;
+              // summary regardless.
-              }
+              core.warning(`Could not post PR comment (status ${err.status ?? 'unknown'}): ${err.message}. Findings are in the job summary.`);
             }