fix(ci): partition pr-review concurrency by draft flag

[topcoder1]

Closes the second of two independent routes to the review / Claude Review fail-open. The trigger half (ready_for_review in types:) is already fleet-wide; this is the other half.

The load-bearing fact: GitHub counts a skipped required context as SATISFIED. So when this check skips, the PR merges green and unreviewed — silently.

How the concurrency group causes that: the reusable gates its job on draft == false, so a stale draft-payload synchronize run is a guaranteed no-op — but in a shared claude-review-<PR> group it can cancel (or replace, if queued) the real ready_for_review run. Result: skipped → satisfied → merged unreviewed. Fixing the trigger alone does not close this.

Why it hits the PRs that matter most: fleet policy makes DRAFT the standard auto-merge opt-out, so every manual-merge / high-risk PR is draft→ready — the recommended workflow was the one most likely to skip review.

Not theoretical: wxa-mcp-server#339 merged unreviewed through this class and took jake-ai down for ~13h (0 tools available) on 2026-07-14/15.

Reference fix: wxa-mcp-server#344. pr-classify, pr-codex-review, claude-author-automerge and safe-paths-automerge already partition this way — pr-review was the lone holdout (same race as attaxion_dev#303).

Non-draft runs keep today's supersede semantics: a newer push still cancels an in-flight stale run.

Note for the merger: claude-code-action rejects PRs whose diff touches their own calling workflow file, so review / Claude Review cannot pass here by construction. Where that check is required, use templates/ci-workflows/scripts/merge-workflow-only-pr.sh.

Auto-merge rationale: MANUAL MERGE — .github/workflows/** is a high-risk surface. CI-config only; no application code.

🤖 Generated with Claude Code

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12