[dangrondahl]

Closes #89. Supersedes #83 (folded in as its own commit, b3d6841).

Why

Every push re-ran a full Opus review. Each round found fresh nits instead of checking whether the last round's findings were fixed: 6 full runs on #87, 3 on #45 for an unchanged dependency diff.

What changes

• Triggers: adds ready_for_review and skips drafts. The fork guard stays on every job.
• Rebase detection: on synchronize, a shell step compares the PR's own diff with the previous push's using git patch-id. A pure rebase onto newer main runs no review in any job. If the old SHA can't be fetched after a force-push, the step assumes the diff changed.
• Dependabot / catalog jobs: run their full review again only when their diff changed.
• General job: a full review on open. Later pushes get a Sonnet follow-up scoped to the new commits: git diff BEFORE AFTER, or git range-diff after a rebase so main's changes aren't included. It reports resolved / partially addressed / not addressed for earlier findings, resolves fixed threads, and flags only bugs, security issues and regressions. If the first full review was cancelled, it reviews the whole PR instead.
• Full review prompt: adds a "what not to report" section, cuts Phase 3 to one sentence, and lets the reviewer read CI results with gh pr checks instead of running npm.
• Outdated rules in the prompt: the general prompt now points at CLAUDE.md instead of restating it. The restated list said org falls back to config.org, the opposite of the rule, and left the version out of User-Agent. The dependency prompt now says tools are registered in src/server.ts.
• CLAUDE.md documents the phasing.

Testing

• Rebase detection was tested in a throwaway repo: a pure rebase compared equal, a real change differed, and range-diff output was checked.
• actionlint (with shellcheck) passes.

Needs a manual review

The action refuses to run when its workflow differs from the default branch (see CLAUDE.md, #33), so this PR can't review itself. It takes effect after merge; check the first follow-up run on the next PR.

Points to look at:

• Model: the follow-up uses claude-sonnet-5-5; the full reviews stay on claude-opus-5.
• Thread resolving: not confirmed that the job's pull-requests: write is enough for the GraphQL resolveReviewThread mutation. If it isn't, threads stay open and the rest still works.
• gh api access: the follow-up allows Bash(gh api:*), as in the CLI repo's workflow. The token is limited to contents: read and pull-requests: write.
• Limits: the follow-up is capped at 30 turns and $2; the full reviews keep 60.