Publish Ruff ecosystem reports from GitHub Actions (astral-sh#29606)

Ruff ecosystem report comments currently depend on `astral-sh-bot`.
Publish `ecosystem-result` after the CI ecosystem job using the shared
STS publisher in astral-sh#29603. Comment IDs come exclusively from the key-value
store.

This handles same-repository pull requests, including runs that upload a
report before failing.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

Author: zanieb

.github/workflows/ci.yaml

@@ -860,8 +860,6 @@ jobs:
           cat ecosystem-result-format-preview >> ecosystem-result
           echo "" >> ecosystem-result
 
-      # NOTE: astral-sh-bot uses this artifact to post comments on PRs.
-      # Make sure to update the bot if you rename the artifact.
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         name: Upload Results
         with:
@@ -875,6 +873,26 @@ jobs:
             exit 1
           fi
 
+  publish-ecosystem-report:
+    needs: ecosystem
+    if: >-
+      !cancelled() && github.event_name == 'pull_request' &&
+      github.repository == 'astral-sh/ruff' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (needs.ecosystem.result == 'success' || needs.ecosystem.result == 'failure')
+    uses: astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@main # zizmor: ignore[unpinned-uses]
+    secrets:
+      KV_API_URL: ${{ secrets.KV_API_URL }}
+      STS_API_URL: ${{ secrets.STS_API_URL }}
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      report: ruff-ecosystem
+      artifact: ecosystem-result
+      filename: ecosystem-result
+      title: "`ruff-ecosystem` results"
+
   fuzz-ty:
     name: "Fuzz for new ty panics/timeouts"
     runs-on: ${{ github.repository == 'astral-sh/ruff' && 'depot-ubuntu-22.04-16' || 'ubuntu-latest' }}