chore(ci): add Claude Code Action for auto PR review and @claude Q&A

Adds .github/workflows/claude.yml which triggers on:
  - pull_request opened/synchronize/reopened -> automatic first-pass review
  - issue_comment / pull_request_review_comment containing "@claude" -> on-demand reply

Safety guards:
  - Skips Dependabot PRs (dep bumps don't benefit from LLM review)
  - Skips fork PRs (GITHUB_TOKEN can't write to forks)
  - Skips bot-authored comments (avoids reply loops)
  - 15 min job timeout + --max-turns 5 cap on Claude conversation length
  - Pinned to claude-opus-4-6

Requires ANTHROPIC_API_KEY secret to be configured in repo settings before
this workflow starts passing. Without it, runs will fail fast with a missing
credential error (not silently).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: beihaili

.github/workflows/claude.yml

@@ -0,0 +1,41 @@
+name: Claude Code Review
+
+# Triggers:
+#   - pull_request opened/synchronize/reopened  -> automatic first-pass review
+#   - issue_comment / pull_request_review_comment containing @claude -> on-demand answer
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  claude:
+    # Skip Dependabot PRs (dep bumps rarely benefit from LLM review and burn API budget).
+    # Skip fork PRs (GITHUB_TOKEN can't write to forks, so the action would run and silently fail).
+    # For comment events, skip ones authored by bots to avoid reply-loops with other integrations.
+    if: >-
+      !(github.event_name == 'pull_request' && (
+        github.event.pull_request.user.login == 'dependabot[bot]' ||
+        github.event.pull_request.head.repo.fork == true
+      )) &&
+      !(github.event.comment != null && endsWith(github.event.comment.user.login, '[bot]'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          trigger_phrase: '@claude'
+          # Pin to Opus 4.6; drop --max-turns lower if budget gets tight.
+          claude_args: --model claude-opus-4-6 --max-turns 5