feat(ci): run secreview headless on PRs and post findings as a comment #12973

Problem

Security review of a diff is currently a manual chore that has to be initiated,
watched, and waited on. Usage analysis over 59 sessions found it was the single
most-requested task (11 sessions) and that 8 of the 11 delivered nothing —
abandoned mid-exploration. #12951 fixed the ordering with the secreview
skill, but the review still only happens if a human remembers to ask for one.

The skill proved its value immediately: dogfooded against PR #12950 it found two
confirmed defects (#12956) — and that PR merged anyway, because the review was
an out-of-band comment rather than a gate.

What existing CI does and does not cover

.github/workflows/security.yml is mature on static tooling: pip-audit, safety,
npm audit, bandit, semgrep, secret detection, SARIF upload to the Security tab.
None of that is duplicated here.

What pattern matchers structurally cannot catch is what the manual reviews kept
finding — semantic defects that need the diff read in context:

• a rename with call sites left un-updated (9 of them, in one session)
• a missing ownership check on an endpoint that otherwise looks correct
• a docstring asserting a guarantee the code does not implement (fix(analytics): _package_router_files maps nested subpackages to the parent prefix, inventing endpoints #12956)
• a fail-open default introduced where the old path failed closed

There is currently no reasoning-based review anywhere in CI:

$ grep -rln "claude" .github/workflows/
(no matches)

Proposed fix

A pull_request workflow that runs the secreview skill headless and posts its
findings table as a PR comment.

Cost control — reviews are billed per run, and credit exhaustion is already a
known failure mode, so the job must be narrow by default:

• path-filtered to backend and auth-adjacent code, not every PR
• skipped on draft PRs
• output capped; the skill's contract is already a table plus a verdict
• advisory (comment only), not a required check — findings inform the human gate
  rather than blocking merge on a probabilistic reviewer

Must be inert-safe. The repo currently has no secrets configured at all
(gh api repos/.../actions/secrets → total_count: 0), so ANTHROPIC_API_KEY
does not exist yet. The workflow must skip cleanly when the secret is absent,
so merging it cannot red every PR before the key is added.

Prerequisite (owner action)

ANTHROPIC_API_KEY must be added as a repository secret before the job does
anything. Until then it is expected to skip.

Acceptance criteria

• Workflow runs on ubuntu-latest, not the self-hosted singleton runner
• Skips cleanly with a visible notice when ANTHROPIC_API_KEY is unset
• Skips draft PRs and PRs touching no filtered paths
• Posts exactly one comment per PR, updated in place rather than appended per push
• Advisory only — does not become a required check
• Passes actionlint
• Does not duplicate any scan already in security.yml