ci: pin review-workflow actions to commit SHAs; state the real merge gate

[fonkamloic]

Fixes #26, porting the fixes already merged on code-push-admin (#19) and code-push-website (#31) onto this repo's workflow (on top of #24's model routing — untouched).

1. SHA pins in a privileged job. actions/checkout and anthropics/claude-code-action were tag-pinned in a job holding pull-requests: write and CLAUDE_CODE_OAUTH_TOKEN. Both now pin full commit SHAs with the tag as a trailing comment. The claude-code-action pin is what v1 resolves to today (5ee796a…) — a pure pin for this repo, not an upgrade. Notably the tag has already moved since issue CI: review workflow pins actions to mutable tags and states the wrong merge gate #26 was filed (the issue recorded d40ddef…) — the mutable-tag risk demonstrating itself; admin/website carry the earlier SHA, and aligning all repos is left as a separate deliberate bump (noted in a workflow comment).
2. The merge gate the prompt states is now the real one — Critical always blocks; ≤2 open Mediums may merge only with each unfixed one filed as its own deferred-medium issue first; ≥3 block. Also fixed the Critical section's "Only Critical findings block" sentence (admin template).
3. id-token: write deliberately untouched per the issue's warning (removal broke the review with OIDC-token fetch failures on the template repos).

⚠️ Review of record: the bot deliberately skips PRs that modify its own workflow file and reports the skip as success — a local /code-review result will be posted on this PR instead; do not read an absent bot comment as a pass. YAML validated; diff is workflow-only.

[fonkamloic]

Local review of record (the bot deliberately skips own-workflow PRs — anti-injection guard; its 8s pass above is that skip). Multi-agent adversarial review of this diff, findings verified against the live actions state:

• ✅ SHA pins verified exact: anthropics/claude-code-action@5ee796a55f92566ecd7e39d70dd613abcbea0d7c is precisely what immutable tag v1.0.197 points to; actions/checkout@11d5960a326750d5838078e36cf38b85af677262 is exactly v4. The final workflow contains no tag- or branch-pinned uses: residue.
• ✅ Merge-gate text matches the project rule (Critical blocks; ≤2 filed Mediums may merge; ≥3 block).
• ✅ No behavior regression: deleted-line audit found no dropped steps/permissions/conditions; the repo stays on GitHub-hosted runners (correct for a public repo — fork-PR risk).
• The single raw finding (pin comment says # v1 rather than the immutable # v1.0.197) was refuted 2/2: the in-file comment is explicitly time-scoped ("at pin time") and the # v1 lineage marker is the standard convention; the SHA is what executes.

Verdict: 0 Critical / 0 Medium / 0 Low confirmed. Gate satisfied — merging.

[fonkamloic]

Local review of record (the bot skips this PR under its own-workflow anti-injection guard, so this multi-agent local review stands in — 3 finders × 2 adversarial skeptics each).

Result: 0 Critical / 0 Medium / 0 confirmed findings.

• Every action reference in the final .github/workflows/claude-review.yml is SHA-pinned — no tag/branch residue. Resolutions verified via gh api: anthropics/claude-code-action @ 5ee796a = the immutable tag v1.0.197 exactly; actions/checkout @ 11d5960 = current v4. Both on-lineage, neither yanked.
• Merge-gate text matches the project rule (Critical blocks; ≤2 filed Mediums may merge; ≥3 block).
• Anti-injection posture intact (own-workflow skip preserved; no pull_request_target + untrusted-checkout + secrets exposure); public repo stays GitHub-hosted (not switched to self-hosted).
• Issue CI: review workflow pins actions to mutable tags and states the wrong merge gate #26's asks are all delivered.
• One tabled Low (refuted as a style nit, recorded not blocking): the pin's trailing # v1 lineage marker could name the immutable # v1.0.197 to be permanently self-verifying; the SHA that executes is already correct, so no runtime or security impact.

✅ CI green, mergeable CLEAN. Gate satisfied — merging.