chore: adopt the shared PR review bot

[shlomicm]

What

Adopts the shared PR review bot: one workflow file, no script. The logic lives in
causematch/cm-agents/actions/pr-review-bot,
so every repo runs the same code instead of a copy that drifts.

Assigns a reviewer and an assignee to open PRs that have neither, spreads load
toward a soft weekly target, and DMs the assignee on Slack.

Nothing to configure

PR_REVIEWER_ROSTER and SLACK_BOT_TOKEN are organisation-level. The action
carries its own script and never checks out this repo, so no .nvmrc and no
devops/ directory are needed.

Already proven

Verified end to end in cm-payments#120, which was assigned by the very bot it was
adopting: cross-repo action resolution, org variable, org secret and all three
permission scopes.

Review the permissions block, not the workflow

An explicit permissions: block makes every unlisted scope none, and no test
can catch a missing one because the unit suite uses a stub client, never a real
token. A missing contents: read shipped in cm2 behind 19 green checks and left
the bot inert for a day.

• no contents: read and the action cannot be fetched
• no pull-requests: write and the review request fails
• no issues: write and the assignee step fails

🤖 Generated with Claude Code

[shlomicm]

Closing: cm-proxy is one of the two public repos in the org, and a public repo cannot consume a private action. access_level: organization on cm-agents permits other private repos, not public ones.

The run confirms it, with all three permissions correctly present:

GITHUB_TOKEN Permissions: Contents: read, Issues: write, PullRequests: write
##[error]Unable to resolve action `causematch/cm-agents`, not found

The only ways round it are making cm-agents public, or copying the script here and accepting the drift the shared action exists to prevent. cm-proxy has no branch protection, so reviewer assignment is cosmetic here either way. Not worth either cost.