ci: Dependabot 判定を github.actor から PR 作成者へ修正

前回の `if: github.actor != 'dependabot[bot]'` は意図どおり動かなかった。
github.actor は「実行を引き起こしたユーザー」を指すため、別 PR をマージして
Dependabot PR が自動 rebase された際、実行が人間（マージした本人）に帰属し
スキップされなかった。PR 作成者を見る pull_request.user.login で判定すれば、
誰が再実行を誘発しても Dependabot PR を安定して識別できる。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nanasess

.github/workflows/claude-code-review.yml

@@ -16,7 +16,12 @@ jobs:
     # the actions/checkout SHA), which makes claude-code-action's OIDC token exchange
     # fail with "Workflow validation failed" because the workflow no longer matches the
     # version on the default branch. Skipping avoids that expected, unavoidable failure.
-    if: github.actor != 'dependabot[bot]'
+    #
+    # Use the PR author (pull_request.user.login), NOT github.actor: github.actor is
+    # whoever triggered the run, so when merging another PR causes Dependabot to rebase
+    # this one, the run is attributed to the human merger and the check would not be
+    # skipped. The PR author stays 'dependabot[bot]' regardless of who triggers the run.
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
 
     # Optional: Filter by PR author
     # if: |