ci: add claude-code-review reusable workflow

[sydorovdmytro]

Summary

• Extracts the Claude Code Review workflow as a reusable workflow_call workflow
• Source: identical workflow in loft-enterprise, vcluster, and vcluster-pro (automatic PR review on pull_request_target)
• SHA-pinned actions/checkout@v6.0.2 and anthropics/claude-code-action@v1
• Added persist-credentials: false on checkout
• Parameterized ANTHROPIC_API_KEY as a workflow_call secret (anthropic-api-key)
• Standardized ${VAR} quoting
• Preserves fork handling (loft-sh owner guard + remote setup for fork PRs)

Security hardening

• Replaced gh CLI tools with local-only tools (Read,Glob,Grep,LS,Bash(git diff:*),Bash(git log:*)) — prevents secret exfiltration via shell expansion in gh pr comment
• Restore CLAUDE.md from base branch before review — prevents prompt injection from PR head
• Added concurrency group — cancels stale review runs on rapid pushes
• Added timeout-minutes: 15 — prevents runaway runner usage
• Removed unused issues: read permission — least privilege

Caller example

name: Claude Code Review

on:
  pull_request_target:
    types: [opened, synchronize, ready_for_review, reopened]

jobs:
  claude-code-review:
    uses: loft-sh/github-actions/.github/workflows/claude-code-review.yaml@claude-code-review/v1
    secrets:
      anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

Test plan

• actionlint passes
• zizmor passes
• CI green
• Tag claude-code-review/v1 after merge
• Migration PRs in loft-enterprise, vcluster, and vcluster-pro

Part of the Phase 3 GitHub Actions centralization effort.