ci: remove the per-PR image size-diff comment

.github/actions/app-tests/action.yaml

@@ -1,7 +1,7 @@
 ---
 # yaml-language-server: $schema=https://json.schemastore.org/github-action.json
 name: App Tests
-description: Takes an app, app image and token then runs app tests
+description: Takes an app and image then runs tests
 
 inputs:
   app:
@@ -10,9 +10,6 @@ inputs:
   image:
     description: Image
     required: true
-  token:
-    description: GitHub Token
-    required: true
 
 runs:
   using: composite

.github/workflows/app-builder.yaml

@@ -181,51 +181,6 @@ jobs:
         with:
           app: ${{ inputs.app }}
           image: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}:sandbox
-          token: ${{ github.token }}
-
-      - name: Export OCI Image
-        if: ${{ ! inputs.release && matrix.platform == 'linux/amd64' }}
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
-        with:
-          files: |
-            ./docker-bake.hcl
-            cwd://${{ runner.temp }}/docker-metadata-action-bake.json
-          set: |
-            *.args.VENDOR=${{ github.repository_owner }}
-            *.cache-from=${{ format('type=registry,ref=ghcr.io/{0}/build_cache:{1}-{2},mode=max', github.repository_owner, inputs.app, steps.target.outputs.arch) }}
-            *.output=type=oci,tar=false,dest=${{ runner.temp }}/image.oci,compression=zstd,force-compression=true
-            *.platform=${{ matrix.platform }}
-            *.tags=
-          source: ./apps/${{ inputs.app }}
-          targets: image
-
-      - name: App Size Diff
-        if: ${{ ! inputs.release && matrix.platform == 'linux/amd64' }}
-        uses: ./.github/actions/app-size-diff
-        id: app-size-diff
-        with:
-          from-app: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}:rolling
-          to-oci-layout: ${{ runner.temp }}/image.oci
-          platform: ${{ matrix.platform }}
-
-      - name: Save Size Diff
-        if: ${{ ! inputs.release && matrix.platform == 'linux/amd64' }}
-        env:
-          MARKDOWN: ${{ steps.app-size-diff.outputs.size-diff-markdown }}
-          APP: ${{ inputs.app }}
-        run: |
-          mkdir -p "${RUNNER_TEMP}/size-diff"
-          printf '%s' "$MARKDOWN" > "${RUNNER_TEMP}/size-diff/body.md"
-          printf '%s' "$APP" > "${RUNNER_TEMP}/size-diff/app"
-
-      - name: Upload Size Diff
-        if: ${{ ! inputs.release && matrix.platform == 'linux/amd64' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: size-diff-${{ inputs.app }}
-          path: ${{ runner.temp }}/size-diff/*
-          if-no-files-found: error
-          retention-days: 1
 
   merge:
     if: ${{ inputs.release }}

.github/zizmor.yml

@@ -6,10 +6,6 @@ rules:
       # with persist-credentials: false and acts only via a scoped app-token,
       # so the dangerous trigger is intentional and contained.
       - labeler.yaml
-      # Size Diff Comment uses workflow_run but never checks out or runs PR code:
-      # it only reads the size-diff artifact and posts a comment, resolving the PR
-      # from the trusted head SHA. Standard secure fork-PR comment pattern.
-      - size-diff-comment.yaml
   template-injection:
     ignore:
       # retry-release interpolates ${{ matrix.app }} / github.repository into a