ci: let the Claude review read files and log refused tool calls

[kanywst]

--allowedTools is a closed list and did not include Read/Grep/Glob, so the reviewer could not open the README / CLAUDE.md its prompt tells it to read (the same workflow in kanywst/bellman logged 4 refused tool calls). Adds them, and prints each refused tool call in the report step. Changes the reviewer itself, so it cannot review this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 618ccc04-50f8-4e2e-9b73-142fdd3201ac

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

No findings. The diff only changes .github/workflows/claude-review.yml. It adds Read,Grep,Glob to the closed allowlist and logs refused tool calls. Permissions stay least-privilege and the new step passes the outputs through env rather than inline expressions.