[ehl-jf]

Summary

• New sample under samples/artifactory/AFTER_DOWNLOAD/ai-download-risk-advisor/: on AFTER_DOWNLOAD, looks up the downloaded artifact's existing Xray scan result (security issues + policy violations).
• If the artifact is clean, the worker stops there — no AI call, no Slack message.
• If issues are found, it asks Claude (Anthropic Messages API) to turn the raw counts into a short, plain-English risk summary and recommendation, then posts it to a Slack channel via incoming webhook.
• Falls back to posting raw Xray stats instead of an AI summary if the AnthropicApiKey secret isn't configured or the Claude call fails, so the advisory never silently disappears.
• minIssuesForAiSummary, claudeModel, and claudeMaxTokens are configurable via the worker's properties (declared with defaults in manifest.json), not hardcoded.
• README covers required secrets, configurable properties, a worked Claude prompt/response walkthrough, and a full end-to-end run guide (prerequisites, secrets, deploy, test download, expected log messages, how to exercise the fallback path).

Test plan

• npx tsc --noEmit — clean
• npm test — 5/5 passing (Xray unavailable, no scan match, clean artifact skips AI call, full Claude+Slack success path, missing-API-key fallback)

Jira: WKS-2791