## Context

Fork PRs receive a read-only `GITHUB_TOKEN`, causing 403 errors on all
label and comment writes
([example](https://github.com/zed-industries/zed/pull/51878)). This
splits the single workflow into two:

- **pr-size-check.yml** (`pull_request`): computes size and guided tour
detection, uploads a JSON artifact — read-only, works for forks
- **pr-size-label.yml** (`workflow_run`): downloads the artifact,
applies labels and comments — runs on the base repo with full write
access

### Security

- Artifact treated as untrusted data: fields are cast and validated
(`Number()`, `String()` + prefix check, `Boolean()`) before use
- No artifact content is executed or interpolated into shell
- Missing artifact handled gracefully (steps skip via output flag)

### Also included

- Structural guided tour detection: extracts "How to Review" section,
strips HTML comment placeholders, checks for actual author content
(fixes false positive in #51957)
- Softer confirmation: "appears to include guidance"

Tested locally end-to-end against 4 real PRs
(XL/small/medium/false-positive).

## How to Review

1. `pr-size-check.yml` — the compute half. Compare against the previous
version: all write operations removed, artifact upload added at the end.
2. `pr-size-label.yml` — new file. Download artifact, validate, apply
labels/comments. Same label logic as before, just in a `workflow_run`
context.

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A