fix: compute custom-code summaries from trusted workflow code (#3692)

## Summary

Compute custom-code summaries from trusted workflow code in a separate
read-only job. Publish its freshly generated report and patch through
the existing comment job, retaining current-PR and run freshness checks.

## Validation

- Focused Castiron unittest suite: 19 tests passed (one optional
compiler test skipped).
- Focused Ruff, Pyright, mypy, and Python compilation checks passed.
- Workflow YAML, shell syntax, action-pin, and offline local-Git
regression checks passed.

The workflow change becomes active after it reaches the default branch.
SDK CODEOWNER review is requested.