ci: add automated PR reviews

[MichaelHabermas]

Add the PR review pipeline used by Web Services so RIOC changes receive scored reviews and inline findings, with follow-up reviews after fixes. Review guidance is adapted to Python/FastAPI; product code is unchanged.

Behavior changes

• Review non-draft, same-repository PRs on opening or marking ready. Pushes require an explicit @claude follow-up or manual workflow dispatch.
• Verify findings before publishing a sticky review tied to the reviewed commit, with a score out of five, progress, and usage details.
• Restrict mention triggers to repository owners, members, and collaborators. Use GitHub-hosted runners and retain trusted base-branch helpers and restricted model tools.
• Keep the review advisory. The introducing PR reports a bootstrap skip until the bot files are on main; this is not an approval.
• Exclude Web Services reviewer routing and Slack notifications. Add dedicated CI for the copied review helpers.

Source: Web Services 5dbaaf6. Setup and repeatable checks: review documentation.

Validation

• Review Bot Tests passed: 12 Node tests, all 11 shell regression suites, shell syntax/ShellCheck, and JSON validation. Workflow lint (actionlint) also passed locally.
• The bootstrap regression fails on the source behavior and passes with the fix. The initial review run correctly reports that trusted runtime files must exist on main; its summary was checked in the in-app browser.
• Full live publishing, the required 5/5 review, and the live review flow in the in-app browser remain blocked until the trusted files are merged into main and authentication is available. No repository-level Actions secrets were present; organization secret access and app installation remain unverified. Install the GitHub review app and provide CLAUDE_CODE_OAUTH_TOKEN access as documented.

QA steps

1. Confirm Review Bot Tests succeeds and the automatic review's bootstrap summary clearly explains why no review ran.
2. After setup and merge, open a small PR and check its scored sticky review, inline findings, and reviewed head SHA.
3. Push a change and comment @claude; confirm the updated review covers the new commit. Check that an outside participant or bot cannot trigger mention reviews.

Screenshots

N/A: no product UI change. No Jira ticket is linked.