refactor: consolidate 3 review phases into single claude-review.yml

Merge claude-review-phase1.yml, phase2.yml, and phase3.yml into one
workflow with conditional jobs:
- basic-review: runs on every PR open/sync (~$1.50)
- detect-high-stakes + review-summary: flags sensitive files
- security-check + claude-fix: opt-in via 'ai-fix' label (~$5-10)
- blocked-security: posts notice when blocked

Also adds branches-ignore filters (ai/*, scanner/*, issue-fix/*, nightly/*)
as defense-in-depth alongside GITHUB_TOKEN loop prevention.

Cost reduced from ~$3/PR (phases 1+2) to ~$1.50/PR (single review job).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Tony363