feat: Add pytest coverage comment to PRs (dev-v4)

- Add permissions block for pull-requests: write
- Add --junitxml=pytest.xml for test summary reporting
- Add MishaKav/pytest-coverage-comment step (pinned by SHA)
- Remove demo-v4 from target branches

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Rafi-Microsoft

.github/workflows/test.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - demo-v4
       - dev-v4
     paths:
       - 'src/backend/**/*.py'
@@ -23,7 +22,6 @@ on:
       - synchronize
     branches:
       - main
-      - demo-v4
       - dev-v4
     paths:
       - 'src/backend/**/*.py'
@@ -35,6 +33,11 @@ on:
       - 'src/**/pyproject.toml'
       - '.github/workflows/test.yml'
 
+permissions:
+  contents: read
+  actions: read
+  pull-requests: write
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -71,9 +74,9 @@ jobs:
         run: |
           # Run test_app.py first (isolation required)
           python -m pytest src/tests/backend/test_app.py --cov=src/backend --cov-config=.coveragerc -q
-          
+
           # Run remaining backend tests with coverage append
-          python -m pytest src/tests/backend --cov=src/backend --cov-append --cov-report=term --cov-report=xml --cov-config=.coveragerc --ignore=src/tests/backend/test_app.py
+          python -m pytest src/tests/backend --cov=src/backend --cov-append --cov-report=term --cov-report=xml --junitxml=pytest.xml --cov-config=.coveragerc --ignore=src/tests/backend/test_app.py
 
       - name: Check coverage threshold
         if: env.skip_tests == 'false'
@@ -91,7 +94,19 @@ jobs:
             exit 1
           fi
 
+      - name: Pytest Coverage Comment
+        if: |
+          always() &&
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.head.repo.fork == false &&
+          env.skip_tests == 'false'
+        uses: MishaKav/pytest-coverage-comment@26f986d2599c288bb62f623d29c2da98609e9cd4  # v1.6.0
+        with:
+          pytest-xml-coverage-path: coverage.xml
+          junitxml-path: pytest.xml
+          report-only-changed-files: true
+
       - name: Skip coverage report if no tests
         if: env.skip_tests == 'true'
         run: |
-          echo "Skipping coverage report because no tests were found."
+          echo "Skipping coverage report because no tests were found."