Add PR visual recap workflow

[rthaut]

Adds .github/workflows/pr-visual-recap.yml, which posts an automatically generated visual recap (interactive diagram/summary plan plus a screenshot in a sticky comment) on non-trivial pull requests, using the Agent-Native recap CLI.

Safety posture:

• Plain pull_request trigger (never pull_request_target), so PR head code never runs with elevated permissions or write tokens.
• Job-level hard gate: only same-repository branches from OWNER/MEMBER/COLLABORATOR authors start the workflow; fork PRs, bot PRs (e.g. Dependabot), and drafts are skipped entirely.
• Inert until secrets are configured: without the model API key the gate no-ops with a green check, so this merges safely ahead of key provisioning.
• Secret scan of the diff fails closed; tiny diffs never invoke the model.

No existing workflows are modified.

[github-actions]

Visual recap — skipped

The visual recap job did not run for this pull request. This is informational only and does not block the PR.

Recap skipped for 7678004: ANTHROPIC_API_KEY not configured (claude backend).