chore(ci): apply review fixes to Claude Code Action workflow

Addresses findings from the /pr-review-toolkit:review-pr pass:

- Invert fork check (`fork != false`) so missing/unknown field defaults to
  "treat as fork, skip" rather than running and silently failing to post.
- Switch bot filter from `endsWith(user.login, '[bot]')` to
  `user.type == 'Bot'`. The `[bot]` suffix only catches bots whose login ends
  that way (dependabot, github-actions, renovate); the API-native `type` flag
  also covers codecov, snyk-bot, mergify, etc.
- Drop `issues: write`. The workflow only posts to PRs and PR comments, so
  `pull-requests: write` is sufficient. Noted in a comment that this means
  Claude can't reply on standalone-issue threads until/unless we add it back.
- Bump `actions/checkout` v4 -> v6 to match deploy.yml and lighthouse.yml.
- Clarify the header comment: the `@claude` filter is inside the action's
  `trigger_phrase`, not at the workflow `on:` layer (the old comment read
  like GitHub itself gated the run).
- Tighten the other inline comments with a clearer "without these guards"
  framing and remove the ambiguous "drop --max-turns lower" phrasing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: beihaili

.github/workflows/claude.yml

@@ -1,8 +1,10 @@
 name: Claude Code Review
 
-# Triggers:
-#   - pull_request opened/synchronize/reopened  -> automatic first-pass review
-#   - issue_comment / pull_request_review_comment containing @claude -> on-demand answer
+# Triggers (the action itself filters comments via `trigger_phrase: '@claude'` below —
+# this workflow runs on every matching event and short-circuits inside the action if
+# the body doesn't contain the trigger phrase):
+#   - pull_request opened/synchronize/reopened -> automatic first-pass review
+#   - issue_comment / pull_request_review_comment (created) -> on-demand answer
 on:
   pull_request:
     types: [opened, synchronize, reopened]
@@ -11,31 +13,38 @@ on:
   pull_request_review_comment:
     types: [created]
 
+# Minimal permissions. Note: dropping `issues: write` means @claude on a pure issue
+# (not a PR) comment can be read but not replied to. Add it back if/when we want
+# Claude to answer standalone-issue threads.
 permissions:
   contents: read
   pull-requests: write
-  issues: write
 
 jobs:
   claude:
-    # Skip Dependabot PRs (dep bumps rarely benefit from LLM review and burn API budget).
-    # Skip fork PRs (GITHUB_TOKEN can't write to forks, so the action would run and silently fail).
-    # For comment events, skip ones authored by bots to avoid reply-loops with other integrations.
+    # Without these guards:
+    #   - Dependabot PRs would burn API budget on dep bumps that rarely need LLM review
+    #   - fork PRs would run but silently fail to post (GITHUB_TOKEN can't write to forks);
+    #     we invert the check to `fork != false` so an unknown/missing field defaults to
+    #     "treat as fork, skip" rather than running and failing silently
+    #   - bot-authored comments could create reply loops; we use `user.type == 'Bot'`
+    #     (GitHub's native flag) instead of a `[bot]` suffix check to also catch
+    #     bots with non-suffixed logins (codecov, snyk-bot, mergify, etc.)
     if: >-
       !(github.event_name == 'pull_request' && (
         github.event.pull_request.user.login == 'dependabot[bot]' ||
-        github.event.pull_request.head.repo.fork == true
+        github.event.pull_request.head.repo.fork != false
       )) &&
-      !(github.event.comment != null && endsWith(github.event.comment.user.login, '[bot]'))
+      !(github.event.comment != null && github.event.comment.user.type == 'Bot')
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           trigger_phrase: '@claude'
-          # Pin to Opus 4.6; drop --max-turns lower if budget gets tight.
+          # Reduce --max-turns (currently 5) if API spend climbs.
           claude_args: --model claude-opus-4-6 --max-turns 5