ci: let the Claude review read files and log refused tool calls

[kanywst]

--allowedTools is a closed list and did not include Read/Grep/Glob, so the reviewer could not open the README / CLAUDE.md its prompt tells it to read (the same workflow in kanywst/bellman logged 4 refused tool calls). Adds them, and prints each refused tool call in the report step. Changes the reviewer itself, so it cannot review this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 82020dfe-5240-42dd-a5fe-f560d0cbb3bb

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

No findings. The diff adds Read,Grep,Glob to the allowlist, which the prompt needs, and a denial logger. The logger takes EXECUTION_FILE from env rather than inline interpolation, and the jq filter degrades safely with || true. Permissions and pinned actions are unchanged.