Pin use-ai-config on the gha Claude bot callers

[d-morrison]

Closes #36.

The premise turned out to be already satisfied

#36 asks whether to wire use-ai-config into the two Morrison-Lab/gha
Claude callers so the reviewer loads the shared corpus directly, on the
understanding that the callers "pass neither, so the reviewer works from
whatever prose the repo happens to carry."

Reading the callee at its pinned tag (the repo's own convention) shows that
premise no longer holds at @v2. In both
Morrison-Lab/gha/.github/workflows/claude.yml@v2 and
claude-code-review.yml@v2, use-ai-config is declared with default: true,
and the review workflow passes it straight through to claude-code-action
(use-ai-config: ${{ inputs.use-ai-config }}, ungated, on both the first
and retry review steps). Our two callers omit the input, so it already
resolves to true. The canonical gha example stubs document this directly:

#   use-ai-config: false        # skip the Morrison-Lab/ai-config plugin (installed by default)

So the bot and the reviewer are already installing ai-config@Morrison-Lab
on every run. What was actually stale is this repo's caller stubs: they were
copied from an older template that predates these inputs and never mention
ai-config, which is what led to the assumption that it was off.

What this PR changes

Rather than a no-op "turn it on," this pins the setting explicitly in both
callers and documents it:

• .github/workflows/claude.yml — adds an active with: block setting
  use-ai-config: true (the @claude bot).
• .github/workflows/claude-code-review.yml — adds use-ai-config: true
  alongside the existing pr-number input (the reviewer).
• Both — add commented plugin-marketplaces / plugins lines to the option
  menu, mirroring the canonical gha stubs, so the extension path is
  discoverable without being activated.
• NEWS.md — an Internal-changes bullet.

Before: ai-config on, via an invisible callee default on a floating tag.
After: ai-config on, pinned and self-documenting in the caller — identical
runtime behaviour, but the intent survives any future move of the @v2
default and the next reader won't repeat the "it's off" assumption. This is
consistent with the repo's copilot-instructions.md convention of reading and
pinning against the callee at its tag.

The three "worth checking" items from #36

• Does enabling it lengthen review runs / raise permission-denials? No
  change from this PR: it is already enabled by default, so existing reviews
  (e.g. on Add AGENTS.md and CLAUDE.md, and correct the stale copilot-instructions.md #37, Dissertation draft: chapters 1–3 and the two chapter manuscripts #31) already run with the corpus loaded. This PR alters no
  runtime input value, only makes the existing one explicit.
• Does the corpus conflict with copilot-instructions.md? Any conflict
  would already be in effect on every review today; none has surfaced. A full
  audit of the ai-config corpus is out of scope for this caller change.
• Set plugins alongside, or use-ai-config alone? use-ai-config
  alone. No additional plugin is needed here, so plugins /
  plugin-marketplaces are left documented-but-commented pending an
  identified need, keeping this diff to the one decision the issue asked for.

Verification

• Both workflow files parse as valid YAML; use-ai-config is a declared
  boolean input on the callee, so true is valid.
• check-new-line-breaks, lint-markdown's list-item-splice check, and the
  table-split check all run clean against the added NEWS.md lines (ran the
  gha@v2 scripts locally against origin/main).
• DESCRIPTION's Version: is untouched, per the version-check convention.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

[github-actions]

Claude finished review — View run

---

Confirmed — only 3 files touched, exactly matching the PR description (DESCRIPTION untouched). I've fully verified the diff. Here's the review.

---

Review: Pin use-ai-config on the gha Claude bot callers (PR #38)

Scope: Two workflow-caller edits (.github/workflows/claude.yml, .github/workflows/claude-code-review.yml) that add an explicit use-ai-config: true to the Morrison-Lab/gha@v2 reusable-workflow calls, plus commented plugin-marketplaces/plugins stub lines and a NEWS.md entry. No runtime behavior changes — this makes an already-active default explicit.

Verification performed

• Fetched Morrison-Lab/gha at tag v2 directly (claude.yml, claude-code-review.yml) and confirmed the PR's central factual claim: use-ai-config is declared type: boolean, default: true in both callee workflows, and is passed through ungated to claude-code-action (claude-code-review.yml lines 1005/1115: use-ai-config: ${{ inputs.use-ai-config }}, both first-pass and retry steps). The PR's description of this is accurate, not a hallucination.
• Confirmed the quoted canonical stub line (# use-ai-config: false # skip the Morrison-Lab/ai-config plugin (installed by default)) exists verbatim in Morrison-Lab/gha's examples/claude.yml:91 and examples/claude-code-review.yml:220.
• Confirmed issue #36 exists and matches the PR's stated premise and its three "worth checking" follow-up items almost exactly.
• Reconstructed both patched YAML files in a sandbox and parsed them with yaml.safe_load — both parse cleanly; the new with: block in claude.yml and the new key in claude-code-review.yml's existing with: block are correctly indented (4-space with:, 6-space keys, matching the surrounding secrets:/with: structure).
• Confirmed only 3 files are touched (claude.yml, claude-code-review.yml, NEWS.md) — DESCRIPTION's Version: is untouched as claimed.
• No CLAUDE.md exists anywhere in this repo, so no CLAUDE.md-compliance check applies.

Findings

None. This is a minimal, well-substantiated, low-risk documentation/pinning change:

• Every external factual claim in the PR body checks out against the actual Morrison-Lab/gha@v2 source.
• YAML is syntactically valid and correctly indented at both edit sites.
• The NEWS.md entry is placed under the correct "Internal changes" heading and follows the surrounding entries' citation convention ((#NN)), consistent with lab-manual coding-style expectations for changelog entries.
• Minor, non-blocking stylistic note only: the added plugin-marketplaces/plugins comment text (# extra marketplaces on top of ai-config / # extra plugins installed alongside ai-config) diverges slightly in wording from the canonical gha example stubs (# further plugin sources / no trailing comment) — intentional repo-specific rephrasing, not an error, not worth blocking on.

Verdict

Ready for merge

Reviewed commit: dc87f8e

[github-actions]

💰 Cost: $0.5130 (review) — run