Propagate PR review skill automation

[Janpot]

Propagate the PR review automation to

• material-ui: [ci] Add Claude PR review via mui-public reusable workflow material-ui#49037
• mui-x: [ci] Add Claude PR review via mui-public reusable workflow mui-x#23423
• bui charts: mui/base-ui-charts#932
• bui mosaic: mui/base-ui-mosaic#434
• mui-private: mui/mui-private#2199

#1815 authenticates the PR head fetch, which every private caller needs; base-ui-plus is repinned onto it (mui/base-ui-plus#195) and verified end to end. Caller pins move forward through Renovate, so no manual repin sweep is needed.

Each new repo also needs its own Anthropic federation rule and workspace, with the shared service account added as a member of that workspace. Without the membership the token exchange returns a bare 401 whose only clue is sa_not_in_workspace in the Console audit events.