ci: add anthropics/claude-code-security-review on every PR

Adds AI-driven security review to the existing static-analysis pipeline
(CodeQL, gosec, Trivy, npm audit, gitleaks, Dependency Review, Scorecard).
Claude reads the diff and flags auth/authz logic bugs, business-logic
flaws, AI-class antipatterns, and prompt-injection vectors that pattern
matchers can't catch. Posts inline review comments.

Matches the repo's existing security-workflow style:
- step-security/harden-runner with audit egress
- permissions: {} at workflow level, scoped per-job
- concurrency control
- third-party actions SHA-pinned per OWASP CI/CD-SEC-2

The action has no tagged releases yet (May 2026), pinned to the head
SHA at time of authoring. Bump when v1 is cut.

One-time setup in repo settings (documented in the workflow header):
1. Add the CLAUDE_API_KEY repo secret (Anthropic API key with Claude
   Code entitlement).
2. Actions -> General -> "Require approval for all external contributors"
   on the fork-PR setting. The repo is PUBLIC and the action is not
   hardened against prompt injection in untrusted PR diffs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

.github/workflows/claude-security-review.yml

@@ -0,0 +1,59 @@
+# AI-driven security review on every PR, complementing the existing static
+# tooling (CodeQL, gosec, Trivy, npm audit, gitleaks, Dependency Review,
+# Scorecard). Claude reviews the diff for auth/authz logic bugs, business-
+# logic flaws, prompt-injection, and the LLM-class antipatterns from
+# Arcanum-Sec/sec-context that pattern matchers can't catch.
+#
+# One-time setup in repo settings:
+#   1. Secrets and variables -> Actions -> New repository secret
+#      Name:  CLAUDE_API_KEY
+#      Value: Anthropic API key with Claude API + Claude Code entitlement
+#             (https://console.anthropic.com/settings/keys)
+#   2. Actions -> General -> "Fork pull request workflows from outside
+#      contributors" -> Require approval for all external contributors.
+#      This repo is PUBLIC -- the action is not hardened against prompt
+#      injection in untrusted PR diffs, so external forks must be gated
+#      on maintainer review before the workflow runs.
+#
+# The action has no tagged releases yet (May 2026); pinned to a SHA per
+# OWASP CI/CD-SEC-2. Bump when v1 is cut.
+
+name: claude-security-review
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: claude-sec-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions: {}
+
+jobs:
+  review:
+    name: Claude Security Review
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # post inline review comments
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2  # action diffs against the parent commit
+
+      - name: Claude Security Review
+        uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
+          # Skip non-source paths the static scanners already cover, plus
+          # generated Go files (templ output) where false positives are common.
+          exclude-directories: "docs"