♻️ refactor(ci): post PR reviews as inline threaded comments

[itisnotyourenv]

Pull Request

Description

Rework the Claude Code Review GitHub Action to submit one PR review with per-line inline comments (severity-tagged 🔴 CRITICAL / 🟡 SUGGESTION / 🔵 QUESTION) plus a structured summary body — instead of posting one monolithic PR comment.

This mirrors the flow already defined in .claude/commands/review_pr.md so local /review_pr invocations and the automated CI review produce the same shape of feedback.

What changed

• Prompt rewritten — review criteria, inline-comment schema, event-selection rule, and summary-body template.
• Single API call for submission — gh api POST /repos/.../pulls/.../reviews with commits[], body, and event, so the review is atomic and carries a verdict.
• Removed redundant context-fetching — claude-code-action already injects PR title/body/diff/changed files; dropped the gh pr view / gh pr diff steps and use ${{ github.repository }} + ${{ github.event.pull_request.head.sha }} directly.
• Permissions — pull-requests: read → write (required to POST a review).
• Allowlist — added Bash(gh api:*) to claude_args; added Bash(git checkout -b *) to local settings.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code quality improvement
• Configuration change

Testing

• Tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested integration scenarios if applicable

N/A — CI workflow change. Validation will happen on the next PR where the workflow runs; the review body / inline comments / verdict should appear as one GitHub review rather than a plain comment.

Code Quality

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have made corresponding changes to the documentation if needed
• Pre-commit hooks pass (run pre-commit run --all-files)
• Ruff linting passes (ruff check src/ tests/)
• Ruff formatting passes (ruff format src/ tests/ --check)

Related Issues

N/A

Additional Notes

• The workflow now requires pull-requests: write. If branch-protection rules limit what the GITHUB_TOKEN can do from forked PRs, reviews on fork PRs may need to run with pull_request_target (not changed here — scoped intentionally).
• Only Bash(gh api:*) is needed for the new flow; the older gh pr comment entry is retained in the allowlist for backward compatibility with any other prompts in the repo.

---

Checklist for Reviewers:

• Code follows project conventions and style guidelines
• Changes are well-tested with appropriate test coverage
• Documentation is updated if necessary
• Security implications have been considered (note: pull-requests: write scope)
• Performance implications have been considered

🤖 Generated with Claude Code