Move the Claude workflows to the shared composite actions

[jantman]

Rewritten. This PR originally inlined the full workflows here. They now live in
jantman/github-actions-workflows
as composite actions, and this is a thin caller. The logic is identical — only its
location changed.

Both workflows become thin callers pinned at @v1:

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 1

      - uses: jantman/github-actions-workflows/claude-pr-review@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

Proven before this landed here

This is the same action that now reviews pull requests on jantman/privatepuppet —
verified posting a real review on jantman/privatepuppet#45 (🔎 5m 5s · 14 turns · $1.3644), correctly scoped to only the commits pushed since its last review.

What changes

	before	after
Review allowlist	varies; several repos had no Skill/Task/Write	Skill,Task,Write,TodoWrite + blanket Bash
Bash	enumerated per repo, silently starving subagents	allowed outright
Logging	display_report off in several repos	on, + transcript/session artifact
Findings	--comment: N loose inline comments	one GitHub review, findings batched inline
Cost/duration	nowhere	job summary and the review footer
A denied tool	green check	fails the check
Agent ends turn without findings	silent	posts its raw message, fails
CI results	not readable	mcp__github_ci__* + actions: read
Fork PRs	action fails red (no secrets)	skipped cleanly
Where the logic lives	one copy per repo	one copy, @v1

Why composite, not workflow_call

claude-code-action's default-branch validation runs server-side at
api.anthropic.com from OIDC claims, and nothing in the action's source says whether it
reads workflow_ref (the caller — fine) or job_workflow_ref (the shared repo — always
fails). With workflow_call that unknown decides whether it works at all. A composite
action never asks the question: it runs as part of this job, so the workflow being
validated is this repo's own file, exactly as before.

What stays here

A composite action can't reach these — by the time one runs the runner is up and the
token is minted: triggers, concurrency, permissions, the fork guard, the trigger
guard, and actions/checkout.

⚠️ This PR can't test itself

It changes .github/workflows/, so claude-code-action's validation guard fires and
claude-review goes green having done nothing. Look for Exiting due to workflow validation skip. The real test is the first PR opened here after this merges.

claude-mention.yml is stricter still: issue_comment workflows always run from the
default branch, so the mention path does nothing until this is merged.

🤖 Generated with Claude Code