The github-script step references warningMessage in createComment, but its
definition was removed in 9ac0c27 while the usage was kept. When a comment
tripped the threshold, the step threw 'ReferenceError: warningMessage is not
defined', which the surrounding try/catch swallowed — so the scam-warning
comment was never posted (only the label was applied). Restore the message,
built from the variables already in scope (author, foundPatterns,
suspiciousLinks).
