Support manual snapshot runs

[MitchLillie]

Why

/snapit currently requires an issue_comment event. npm is rejecting OIDC exchanges for comment-triggered workflows while accepting otherwise-identical workflow_dispatch runs, so consumers need a manual fallback.

What changed

• accept a pull_request_number input for workflow_dispatch runs
• validate the triggering actor has write access before publishing
• check out and publish the selected PR
• post the result to the PR while skipping comment reactions when there is no trigger comment
• optionally include private packages in snapshot output, allowing callers to replace the stale private-package action branch
• document the manual workflow configuration and command

The existing /snapit comment path is unchanged.

Validation

• npm run build
• npm run lint
• git diff --check

npx tsc --noEmit remains blocked by existing incompatible Octokit declaration files (POST /repos/{owner}/{repo}/pages/deployment).

[MitchLillie]

Closing in favor of the smaller repo-local fallback in https://github.com/Shopify/app-bridge/pull/3432, matching the approach in Shopify/cli#8583. App Bridge can publish public snapshots through its already-trusted release.yml workflow without changing the shared action.