Authorize binary-size comments through KV and STS (#22822)
Binary-size reports need persistent comment IDs so later runs can update
reports without listing pull request comments. Grant `read` and `write`
access to `pull-request` KV state for the pinned
`publish-binary-size.yml` revision, and move the existing STS comment
grants from `binary-size.yml` to that revision. The grants apply to
`ci.yml` pull-request runs on `refs/pull/*/merge` in the `automations`
environment for `astral-sh/uv` and `astral-sh/uv-dev`.
This policy can merge before the workflows in astral-sh/uv-dev#2730; it
does not enable reporting by itself.
---------
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>