Harden Claude review workflow against untrusted PR content

[akoumpa]

Problem

The reusable Claude review workflow checks out the pull request head into the workspace root before invoking anthropics/claude-code-action. For issue_comment workflows, this lets untrusted PR-controlled project instructions and skills become Claude configuration while the job has an inference credential and pull-request write permissions.

The workflow also validates actor permissions only inside the Claude action, after checkout and reaction steps, enables full tool output in public logs, and uses mutable action tags.

Proposed change

• Validate that the triggering actor has write permission before handling PR content.
• Require an exact trigger phrase.
• Keep the trusted base revision at the workspace root and check out the PR head under pr-head/.
• Pass immutable PR metadata to Claude and require head/diff completeness checks.
• Disable full output, remove unused OIDC permission, narrow write tools, and pin action revisions.
• Add timeout and per-PR concurrency controls after authorization.

Expected impact

Claude reviews continue to be triggered with /claude review, but PR-controlled files are treated as untrusted review input rather than project configuration. Incomplete or stale reviews fail closed instead of producing an LGTM.