ci: enable Claude PR reviews on this repo

[crowecawcaw]

What was the problem/requirement? (What/Why)

This repo hosts the Claude PR-review workflows, but its own PRs aren't reviewed by them. Changes to the review tooling are exactly the ones where an extra reviewer helps.

What was the solution? (How)

Add the same two thin callers aws-deadline/deadline-cloud uses, copied unchanged except for header comments:

• claude_pr_review_collect.yml: a no-op stage on pull_request (permissions: {}) whose completion fires workflow_run.
• claude_pr_review.yml: the review stage on workflow_run. It forwards the trusted head repo and head SHA from the event payload, plus the AWS_CLAUDE_PR_REVIEW_ROLE secret.

Both call this repo's reusable workflows by @mainline, like every other caller. workflow_run also runs from the default branch. So a PR that changes the review workflow is reviewed by the version already on mainline, never by its own copy.

What is the impact of this change?

PRs to this repo get Claude reviews.

Before merging, a repo admin needs to add the AWS_CLAUDE_PR_REVIEW_ROLE repository secret (the same role ARN deadline-cloud uses). Without it, every review run fails at the credentials step. The role's OIDC trust is documented as repo:aws-deadline/*:* with job_workflow_ref pinned to this repo's reusable workflow, which already covers this repo; it's worth confirming.

How was this change tested?

• zizmor 1.23.1: no findings (the dangerous-triggers ignore is the same as deadline-cloud's). actionlint: clean.
• The files match deadline-cloud's callers, which run in production, apart from comments.
• Not run end-to-end: the review can't run until this is merged and the secret exists. The first PR after that is the test.

Was this change documented?

In the workflow header comments.

Is this a breaking change?

No.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[larrygao001]

Before merging, a repo admin needs to add the AWS_CLAUDE_PR_REVIEW_ROLE repository secret

Will you follow up on this and confirm it works as it was not tested end to end?