Ci: fix issue-to-PR inside the container

[JumpLink]

Follow-up to #172. The first dispatch of the repaired workflow failed on both open submissions with node: command not found.

JS actions (actions/github-script) run on the runner's own node mounted into the container, but a run: step only sees what the image ships — and fedora:43 ships none. The render step sat ahead of actions/setup-node. Moved setup-node in front of it; it still runs before the dependency install, so an unusable submission fails in seconds rather than after a full install.

Two more container defects found alongside it:

• runner.temp is the host path. In a container job the expression yields /home/runner/work/_temp while $RUNNER_TEMP yields the mounted /__w/_temp. EXAMPLE_ERROR_FILE therefore pointed at a directory that does not exist inside the container, so the rejection reason could never be read back. Use the env var on both the writing and the reading side.
• The failure comment blamed the contributor for every failure. Only the renderer writes a reason file, and only for input it rejected; anything else is the automation's problem. The failed dispatch posted "This submission could not be turned into a pull request" on two perfectly valid examples. It now distinguishes the two cases and says explicitly when nothing is wrong with the submission. (Those two comments have been deleted.)

Also: claim the work tree with safe.directory once after checkout rather than only in front of git commit, and emit displayMemory pre-wrapped so the rendered meta.ts is already canonical and gjsify format has nothing to rewrite — verified with gjsify format --check against both open submissions.

https://claude.ai/code/session_01FrdNDUY1rJWBJsDU1KAwKj