[Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged)

[don-petry]

Parent: #497 · Work type: Infra · Fan-out (B), ring-staged.

Convert the 4 consumer repos (bmad-bgreat-suite, google-app-scripts, markets, ContentTwin) from vendored copies (the deploy clobber) to thin reusable callers pinned to @pr-review/stable (and @dev-lead/stable). Stage by ring: ring 1 = one low-traffic consumer first, validate healthy, then ring 2 = the rest.

Acceptance: no consumer runs @main or a vendored copy; each pins a channel tag; DON_PETRY_BOT_GH_PAT_CLASSIC (visibility=all) reaches them. Retire deploy-pr-review.yml/force-deploy-pr-review.yml once converted.

Blocked-by dev-lead self-host (so dev-lead/stable is a real pinned release before consumers reference it).

[don-petry]

Re-scoped + unblocked from #535. Consumers already call the wrapper pr-review-reusable.yml@main with secrets: inherit, but the wrapper (a) pins pr-review.yml@main (bleeding), (b) passes no agent_ref (scripts unpinned, #506), and (c) drops DON_PETRY_BOT_GH_PAT_CLASSIC (its explicit secret list omits it) → consumers can't approve. Fix per consumer: call pr-review.yml@pr-review/stable directly with agent_ref: pr-review/stable + secrets: inherit (mirrors .github-private's pr-review-trigger.yml). Ring 1 = one low-traffic consumer, validate, then ring 2. The dev-lead consumer pinning (@dev-lead/stable) is tracked separately and stays gated on #535.

[don-petry]

Ring-1 (markets) surfaced a real bug (the value of ring-staging): pr-review.yml's 'Checkout agent repo' cloned the caller's repo (no repository:), so consumer runs tried markets@pr-review/stable (no such ref) → checkout failure. Worked for self-host only because the caller was .github-private. Fixed in PR #538 (explicit repository: petry-projects/.github-private). Will promote to v1.5.0 and re-validate markets#261 before ring-2.