chore(ci): delegate AI review to the org-shared reusable workflow (#122)

* chore(ci): delegate AI review to the org-shared reusable workflow

Replaces four hand-rolled review jobs (claude/codex x packages/general)
with a single call to Provable-Games/.github code-review.yml@v1. Review
logic, prompt assembly, comment upserting and model config now live in
one place, so a model deprecation is an org-variable change rather than
an edit here. This repo supplies only .github/review-agents.json plus
the existing .github/prompts/*.md.

Net -577 lines. Also drops the local AI-availability gate: the shared
workflow owns fork skipping, so the `changes` job no longer computes
can_run_ai_reviews and the pr-ci aggregate is back to a plain
did-any-job-fail check.

The general agent enumerates top-level paths rather than using the
documented ["."] catch-all: the shared workflow's matcher is prefix
based, so ["."] only matches dotfiles and would silently skip review on
README.md / Scarb.toml / codecov.yml-only PRs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(ci): use the documented catch-all and restore the severity gate

Both depend on shared-workflow changes that have now landed at v1.

review-agents.json: the general agent goes back to the documented
diff_paths ["."] + exclude_paths ["packages/"]. The enumerated top-level
list was a workaround for the prefix matcher treating "." as a dotfile
prefix (fixed in Provable-Games/.github#1), and it silently missed any
new root file — LICENSE and docs/** matched no agent at all.

pr-ci.yml: block_on_severity: true restores the merge gate the inline
review jobs had (Provable-Games/.github#2). Without it a [CRITICAL]
finding would only post a comment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(ci): record why the review job pins @v1 and inherits secrets

Both were flagged as reproducibility/least-privilege risks in review.
Keeping them, deliberately: @v1 is the org convention every caller uses
and is what makes an upstream model change a one-place fix, and the
callee is first-party and declares exactly the two secrets it uses.
Pinning a SHA or enumerating secrets here would diverge from the other
six callers for no practical gain.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: starknetdev

.github/review-agents.json

@@ -0,0 +1,17 @@
+{
+  "agents": [
+    {
+      "agent_id": "packages",
+      "agent_name": "Cairo Packages",
+      "prompt_file": ".github/prompts/cairo-review.md",
+      "diff_paths": ["packages/"]
+    },
+    {
+      "agent_id": "general",
+      "agent_name": "General Engineering",
+      "prompt_file": ".github/prompts/general-purpose.md",
+      "diff_paths": ["."],
+      "exclude_paths": ["packages/"]
+    }
+  ]
+}