ci: keep Bundle Size job green on transient GitHub comment failures

[thymikee]

Why

On PR #1789 (run 32050847506) the size measurement and job summary completed fine, then --post-comment got a 503 No server is currently available from the GitHub comments API during an incident and the whole Bundle Size lane went red. The lane's actual job had already succeeded; only the cosmetic comment write failed.

What

In scripts/size-report.mjs, the --post-comment path is now best-effort against transient GitHub failures:

• Both HTTP calls in that path (list existing comments, then POST/PATCH) go through a new githubRequest helper that retries 4 attempts with 1s/2s/4s backoff on 5xx, 429, or a network error.
• If it still fails, it throws TransientGitHubError; the top-level wrapper prints a ::warning:: annotation, appends a one-line note to $GITHUB_STEP_SUMMARY, and exits 0.
• Any other non-OK status (401/403/404/422…) throws immediately with no retry, so real misconfiguration (bad token, missing permissions) still fails the job.
• assertGitHubWriteResponse is removed; it was only used by this comment write, which was the sole GitHub write in the file, so nothing else depended on it staying fatal.

size.yml needs no change: it already appends the full report to $GITHUB_STEP_SUMMARY before the comment step, so the numbers were never lost — only the comment.

Verification

No unit tests exist for this script, so I exercised it end-to-end with a stubbed fetch (node --import stub.mjs scripts/size-report.mjs --post-comment …) across status sequences:

sequence	result
200,200	posts, exit 0
503,200,200 / net,200,200	retries, posts, exit 0
503×4 / 429×4	warning + summary note, exit 0
401 / 200,404	fatal, exit 1

oxfmt --check and oxlint --deny-warnings pass on the file.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.26 MB	2.26 MB	0 B
JS gzip	744.4 kB	744.4 kB	0 B
npm tarball	863.7 kB	863.7 kB	0 B
npm unpacked	3.01 MB	3.01 MB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	28.0 ms	29.2 ms	+1.1 ms
CLI --help	67.6 ms	66.8 ms	-0.8 ms

Top changed chunks: no changes in the largest emitted chunks.

[thymikee]

Request changes: The retry wrapper blindly reissues the initial POST after a network/5xx failure. That request may have succeeded server-side before its response was lost, so retries can create duplicate marker comments. Make creation idempotent or reconcile after an uncertain create rather than repeating POST unchanged. The exact head also fails required Fallow Code Quality because attemptGitHubRequest exceeds complexity/CRAP thresholds. Add focused committed regressions for transient exhaustion (warn + exit 0), fatal 4xx (nonzero), and uncertain-create reconciliation, with planted/reverted red evidence. Please also use the required ## Summary / ## Validation body structure. Bundle Size passes normally; CodeQL Python 503 appears infrastructural, but Fallow is a real blocker.