CI: fix claude-code-review.yml, bump Actions, add gate job

[jnasbyupgrade]

Have claude setup branch protection when this merges! (requiring the new
all-checks-passed context on main -- see the last bullet below.)

Summary

This PR now bundles every open CI-only PR in this repo (all diffs confined to
.github/workflows/), consolidated per request rather than left as separate
overlapping PRs:

• Same issue as claude-code-review.yml: add missing --comment flag pgxntool-test#61 and claude-code-review.yml: add missing --comment flag pgxntool#84: the /code-review plugin only prints its findings to the job log by default; it needs --comment to post a PR comment. This workflow's prompt was missing that flag, so every automated review has run (real API cost, correct analysis) but never posted anything visible to the PR.
• Fixes the fork-checkout step, which redirected origin to the PR's fork via repository:/ref: + allow-unsafe-pr-checkout: true. That breaks anthropics/claude-code-action's own internal git fetch origin pull/<N>/head (a ref that only exists on the base repo) with "couldn't find remote ref pull//head" -- same bug root-caused and fixed in CI: fix claude-code-review by removing the fork-checkout step entirely extension_tools#28. Fixed the same way: drop the override, just check out the base branch.
• Adds track_progress: true (live-updating tracking comment instead of a silent run until completion -- cat_tools PR #69) and a claude-debug PR label toggle (skips the cost gate + turns on show_full_output for a fast debug iteration -- cat_tools PR #64).
• Adds permissions: actions: write (there's no narrower "cache-write-only" scope; without it claude-code-action's own setup step silently fails to save its Actions cache every run -- cat_tools PR #47) and claude_args: --allowedTools mcp__github_inline_comment__create_inline_comment (agent-mode claude-code-action only starts the inline-comment MCP server if this is listed here, not from the plugin's own frontmatter; without it every review silently falls back to one consolidated comment instead of real inline comments -- cat_tools PR #62).
• Folds in Fix claude-code-review.yml trust gate: check PR author, not head repo owner #6 (closed in favor of this PR): the trust gate checked head.repo.owner.login, which only identifies fork ownership for fork-headed PRs. For an upstream-branch-headed PR (same-repo branch, e.g. from gh stack), that's always the org itself, never the actual author -- silently skipping review on PRs that were legitimately the trusted account's own work. Now checks github.event.pull_request.user.login instead.
• Folds in CI: bump GitHub Actions to latest versions #4 (closed in favor of this PR): bumps the remaining actions/checkout@v6 pins (on claude.yml and ci.yml's test job) to v7. Its bump to this file's own checkout step is superseded by this PR's fork-checkout fix above, which already moved to v7 as part of removing the broken override.
• Folds in CI: add all-checks-passed gate job #7 (closed in favor of this PR): adds a stable all-checks-passed job to ci.yml (needs: [test], if: always()) as a required-status-check name that survives future job renames/matrix changes, instead of requiring a real job name directly -- mirrors Postgres-Extensions/pg_count_nulls' pattern. Also drops paths-ignore: '**.md' from ci.yml's triggers: with it, a doc-only push/PR never runs the workflow at all, so a required all-checks-passed check would sit stuck Pending in branch protection forever instead of passing. This PR does not itself configure branch protection -- that's a live repo setting (gh api --method PUT .../branches/main/protection), not something a git merge can apply; needs to be done manually after merge.
• Most of the claude-code-review.yml-specific fixes (everything except the trust-gate author check) were ported from cat_tools' current, live claude-code-review.yml, which already has all of them.

Test plan

• This change only affects GitHub Actions workflow files.
• The --comment fix was live-verified against pgxntool-test's identical workflow before being ported here unchanged.
• Per the pull_request_target-workflows-can't-verify-themselves rule: this PR's own claude-review check still runs the OLD workflow off main and can't demonstrate any of the claude-code-review.yml fixes on itself. Verification (fork-checkout no longer errors, tracking comment appears, claude-debug label works, cache-write warning gone, inline comments post, review no longer skips on upstream-branch PRs) only happens on a subsequent PR after this merges.
• After merge: configure branch protection on main requiring the all-checks-passed context, then confirm on an open PR that mergeStateStatus reflects a real pending/completed run rather than showing CLEAN with no check having run.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5489dc6d-ec7f-4749-9f09-c97c33b3afd9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}