fix(ci): accept CLA signature comment variants

[xiaoyaner0201]

Summary

• allow the CLA workflow's issue_comment gate to accept the canonical signing sentence when CLA Assistant Lite appends its documented e-mail or company suffix
• preserve the existing exact recheck path and every pull_request_target run
• add an offline regression test that reads .github/workflows/cla.yml and exercises accepted and rejected event/body combinations

The implementation deliberately does not set custom-pr-sign-comment: at the pinned action revision, any nonempty custom signing comment switches the action's own matching to exact equality and would reject the existing suffix-bearing signatures once the workflow starts.

Type of Change

• Bug fix
• New feature
• Performance improvement
• Documentation/Tests

Objective

This is the bounded trigger fix discussed in issue #1727. It changes only the workflow gate and adds its regression fence; it does not change the CLA document, signature ledger, action pin, permissions, tokens, or branch protection.

Issue checkpoint

Issue #1727 remains open. The pre-implementation checkpoint is #1727 (comment). At publication time, the live default branch was main at aab852df94413fd0d55cbea2b7886173020281d5, and no existing PR used head xiaoyaner0201:fix/1727-cla-signature-trigger.

This Draft intentionally references #1727 without an automatic-closing keyword. It must remain Draft and must not merge until maintainers review the contributor-governance behavior and required checks complete.

Testing

• Unit tests added/updated
• Integration tests added/updated
• All existing tests pass

Focused verification on the exact published candidate:

• GRAPHITI_TELEMETRY_ENABLED=false uv run pytest tests/test_cla_workflow.py -q — 1 passed; one unrelated Pydantic deprecation warning
• uv run ruff check tests/test_cla_workflow.py — passed
• git diff --check aab852df94413fd0d55cbea2b7886173020281d5..HEAD — passed
• actionlint — unavailable/not installed locally, so no actionlint result is claimed

Published candidate identity:

• HEAD: 5b995104dc9823573c178e6a53de5b032ba61cfd
• tree: 1ad7ceecdfdd0504203c36bbedc11a10af684837
• changed files: .github/workflows/cla.yml, tests/test_cla_workflow.py

Governance and review limitation

This publication does not establish independent one-to-one governance review. The operational GitHub identity involved in the contribution/publication path may overlap with a repository governor or reviewer identity. Nothing in this Draft or its pre-publication technical verification is a public approval claim. A separate maintainer/CODEOWNER review and the repository's required approval/check rules remain necessary.

Breaking Changes

• This PR contains breaking changes

Checklist

• Code follows project style guidelines for the focused changed test (ruff check passes)
• Exact-tree technical self-review completed
• Documentation updated where necessary
• No secrets or sensitive information committed

Related Issues

Related to #1727 (non-closing while Draft).