harness canary: post the verdict on the drift issue that dispatched the run

[davidcrowe]

Reporter side of the drift-scout pairing (gatewaystack-connect PR feat/drift-canary-pairing). The drift scout dispatches harness-release with client_payload {harness, drift_issue, version, drift_kind, close_on_pass} when an upstream release signal of a harness/SDK moves.

Workflow

.github/workflows/harness-canary.yml: both report steps (harness and sdk jobs) read client_payload.drift_issue / version / drift_kind / close_on_pass into env and pass them to the reporter as --drift-issue, --drift-version, --drift-kind, --drift-close (each only when set, so scheduled and manual runs are unchanged). Header comment documents the pairing.

Reporter

scripts/canary-report.mjs: the canary-issue logic is unchanged and now returns the canary issue URL; when --drift-issue is present it comments on that drift issue in davidcrowe/gatewaystack-connect:

• pass: Canary <leg> on <version>: ✅ passed: safe to close and closes the drift issue (state_reason: completed) when closing is on;
• fail: Canary <leg> on <version>: ❌ failed at <step>: see <canary issue url> (run URL when no canary issue exists).

Close-on-pass is an explicit option: default ON for --drift-kind release (the only kind the scout dispatches today), OFF for --drift-kind docs; close_on_pass: false in the payload / --drift-close off overrides. Best effort: a drift-side failure is logged and never fails the reporter, so the canary issue stays the primary record. CANARY_ISSUES_TOKEN already covers the comment and close (same repo, Issues: read and write); no new secret here. The scout's dispatch credential (CANARY_DISPATCH_TOKEN) is documented in gatewaystack-connect docs/drift-scout.md.

Checks

• npx --yes js-yaml .github/workflows/harness-canary.yml > /dev/null: ok
• node --check scripts/canary-report.mjs: ok
• --dry-run with --drift-issue 1404: success -> comment + PATCH closed; failure with --drift-kind docs -> canary issue created + drift comment, no close.

Docs: docs/harness-canary.md gains a Drift pairing section.