ci: forward approved users to Claude review (#2078)

.github/workflows/claude-code-review.yml

@@ -153,6 +153,10 @@ jobs:
           # enough for the action to post review comments. Author will be
           # github-actions[bot] on this path.
           github_token: ${{ secrets.GITHUB_TOKEN }}
+          # The job gate above approves this fork author through either the
+          # repository allowlist or a maintainer's safe-to-review label. Pass
+          # that approved actor through Claude's independent permission gate.
+          allowed_non_write_users: ${{ github.event.pull_request.user.login }}
           track_progress: ${{ github.event.action != 'labeled' }}
           allowed_bots: "*"
           prompt: |

.github/workflows/lint-action-pinning.yml

@@ -7,6 +7,7 @@ on:
       - ".github/workflows/**"
       - ".github/scripts/lint-action-pinning.py"
       - ".github/scripts/lint-action-pinning_test.py"
+      - ".github/scripts/claude-code-review-workflow-contract_test.py"
       - ".github/scripts/collect-macos-desktop-diagnostics.sh"
       - ".github/scripts/release-workflow-contract_test.py"
       - ".github/release-signing-key.asc"
@@ -17,6 +18,7 @@ on:
       - ".github/workflows/**"
       - ".github/scripts/lint-action-pinning.py"
       - ".github/scripts/lint-action-pinning_test.py"
+      - ".github/scripts/claude-code-review-workflow-contract_test.py"
       - ".github/scripts/collect-macos-desktop-diagnostics.sh"
       - ".github/scripts/release-workflow-contract_test.py"
       - ".github/release-signing-key.asc"
@@ -44,6 +46,9 @@ jobs:
       - name: Test action-pinning lint
         run: python3 .github/scripts/lint-action-pinning_test.py
 
+      - name: Test Claude Code review workflow contract
+        run: python3 .github/scripts/claude-code-review-workflow-contract_test.py
+
       - name: Test release workflow contract
         run: python3 .github/scripts/release-workflow-contract_test.py