ci: backport claude-code-review workflow onto SDTD_040_beta_release

.github/workflows/claude-code-review.yml

@@ -0,0 +1,53 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    # base-branch filter: PRs *into* SDTD_032_dev or SDTD_040_beta_release, or into any
+    # branch in the chained remediation-PR stack (2-5), so Claude also fires on chained PRs.
+    # SDTD_040_beta_release added when this workflow was backported onto the release line
+    # (it previously only had release.yml, so forkni-internal PRs against it had no CI gate).
+    branches:
+      [
+        SDTD_032_dev,
+        SDTD_040_beta_release,
+        refactor/remediation-phases-1-4,
+        perf/unet-step-subphase-5x,
+        perf/trt-zero-copy-audit-hardening,
+        refactor/param-schema-fp8-preflight,
+      ]
+
+jobs:
+  review:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          track_progress: true # forces tag mode -> sticky comment updates in place
+          use_sticky_comment: true # one review comment across pushes, not a new one each time
+          show_full_output: true # surfaces full tool output/denials in the run log for debugging
+          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
+          plugins: "code-review@claude-code-plugins"
+          prompt: "/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
+          claude_args: >-
+            --max-turns 60
+            --allowedTools "Bash(git diff:*),Bash(git status:*),Bash(git log:*),Bash(git fetch:*),Bash(git merge-base:*),Bash(git rev-parse:*),Bash(git remote:*),Bash(git branch:*),Bash(git show:*),Bash(echo:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh release view:*),Bash(python:*),Bash(python3:*),Bash(pytest:*),Skill,Write(/tmp/*)"
+            --append-system-prompt "Repo-specific focus: real-time diffusion hot-path discipline (flag
+            .item()/.cpu()/.numpy()/print(tensor) in step/frame loops), no hard-coded .cuda()/device,
+            best-effort error paths must never raise into the render loop, use raise ... from e, TensorRT
+            zero-copy buffer safety (dtype/shape/lifetime). Honor intentional style: keep
+            typing.Dict/Optional/Union (no PEP585/604 rewrites), line-length 119, single-letter math vars
+            OK, torch.device valid as a default arg. Skip nits ruff/pyrefly already cover.
+            Tool usage: never run filesystem-wide search (find /, grep -r /), stay inside the repo
+            checkout. Never redirect Bash output to a file with > or >>, it is blocked; pipe to head/tail
+            or just read the direct stdout instead."