ci(compat-report): extract render script + add unit test

[phramz]

Context

The compat-report job in .github/workflows/ci.yml builds the sticky-PR-comment markdown body via ~50 lines of in-line bash with two embedded jq invocations (lines ~213-269). That block is load-bearing for operator triage — when a maintainer's PR goes red on the canonical cell, the comment is the first signal they see.

The block is currently not exercisable by any test. PR #77 hit a jq syntax bug (``` is not a valid JSON-string escape) that wasn't caught until CI ran (commit 98e152f). A shell-level unit test would have caught it locally.

Suggested shape

• Move the rendering block to .github/workflows/scripts/render-compat-report.sh
• Add make test-compat-report that pipes a fixture deviations.json through the script and diffs against an expected-comment.md golden
• Hook it into make check

Acceptance

• The compat-report job's "Render comment body" step shrinks to one or two lines that just call the script
• A regression in the markdown shape fails locally before reaching CI