Use github CLI for PR comments and remove `iterative/setup-cml` action

[rugeli]

Use Case

the CI currently runs iterative/setup-cml action for posting PR comments and generating reports. Since this action is less maintained and starts causing issues, we need to remove it and use the native github CLI instead.

Proposed Solution

replace all instances of iterative/setup-cml with github CLI commands for PR commenting and reporting

[rugeli]

Note 12/9/25
reopening this because the duplication check logic in the job isn’t keeping just one dependabot report. I’ll work on a fix