Add reusable AI code review workflow

[mahangu]

Changes proposed in this Pull Request

Adds a reusable AI code review workflow for WooCommerce repos, powered by Claude (Opus 4.6) via anthropics/claude-code-action.

Part of the AI Code Reviews for wpcom/MC/Woo project. See QAO-392.

What it does

• Reusable workflow (workflow_call) that extension repos call with a ~15 line caller file
• Gated to members of the happiness-engineers and qualityops GitHub teams
• Reviews PRs for backwards compatibility, security, WooCommerce best practices, PHP 8.x compat, and performance
• Posts inline comments on specific lines via the batched review API (single notification)
• Supports incremental follow-up reviews on subsequent pushes (two-tier: clean incremental diff when possible, prompt-based dedup after rebases)
• Discovers and applies per-repo ai-review-rules.md files (read from base branch for security)
• Concurrency control: cancels stale reviews when new commits are pushed
• Fork PRs blocked, draft PRs skipped
• Requires AI_CODE_REVIEW_ANTHROPIC_API_KEY org-level secret

Security review

• No secrets exposed in public YAML
• Shell injection mitigated (all GitHub expressions via env vars, not inline)
• Tool access restricted: Write limited to ai_review_payload.json, gh api limited to pulls/reviews and pulls/comments endpoints
• ai-review-rules.md read from base branch (not PR branch) to prevent prompt injection
• Previous review detection filters to github-actions[bot] authored reviews only
• id-token: write required by claude-code-action for OIDC authentication
• Risk assessment: LOW (see PR discussion)

Caller workflow example

name: AI Code Review
on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]

concurrency:
  group: ai-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  review:
    uses: woocommerce/.github/.github/workflows/ai-code-review.yml@main
    secrets:
      AI_CODE_REVIEW_ANTHROPIC_API_KEY: ${{ secrets.AI_CODE_REVIEW_ANTHROPIC_API_KEY }}

How to test the changes in this Pull Request

1. Merge this PR to trunk
2. In a target repo that has the AI_CODE_REVIEW_ANTHROPIC_API_KEY secret, merge the caller workflow above to the default branch
3. Open a non-draft PR from a user on the happiness-engineers or qualityops team
4. Verify the AI review posts inline comments as a single batched review
5. Push a follow-up commit and verify incremental review (Tier 1: Resolved/Still Outstanding/New)

Testing that has already taken place

Workflow reviewed by 5 automated agents: action compatibility, prompt quality, shell correctness, security, and bash security. All critical findings fixed. OIDC workflow validation requires merge to default branch before end-to-end testing.