Add automated structured code review

[bigboateng]

Summary

• add a read-only structured review job for trusted pull requests
• publish validated findings as one GitHub review
• keep fork pull requests and unconfigured repositories fail-closed
• default to gpt-5.6-sol with high reasoning effort

Verification

• actionlint
• 30 repository contract tests
• release-note validation and policy
• git diff --check

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.98

The workflow can review the wrong change set for stale branches, exposes its write-scoped checkout credential to untrusted model input, and has no handling for oversized diffs.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.93

The workflow introduces two concrete review-integrity failures: proposed prompt content governs its own review, and valid findings about complete deletions cannot be published. Model-level verification is not recommended before merge; targeted workflow regression tests are sufficient.