Copilot reviews trigger 'Approve and run workflows' prompt on PRs

[d-morrison]

Symptom

When GitHub Copilot's code-review bot reviews a PR, an Approve and run workflows button appears on the PR. Clicking it lets the run proceed; otherwise it sits in `action_required` state indefinitely.

Root cause

• `.github/workflows/claude.yml` triggers on `pull_request_review` and `pull_request_review_comment` from any actor.
• The repo's Actions setting Require approval for first-time contributors treats Copilot as a first-time contributor, so its review-triggered runs get parked in `action_required`.
• The `if: contains(... '@claude')` guard does not help — GitHub evaluates the approval gate before the `if:`, so the run queues even when it would be a no-op.

Options considered

Option	What it does	Tradeoff
A — Settings → Actions → General → set "Fork pull request workflows from outside collaborators" to "Disabled" or "first-time contributors who haven't made any prior commits"	Kills the prompt globally	Also lowers the approval bar for fork PRs
B — Drop `pull_request_review` and `pull_request_review_comment` from `claude.yml` triggers	Kills the prompt; preserves security posture	Lose `@claude` from overall review bodies and inline review comments. Only top-level PR comments and issues still work.
C (chosen for now) — Live with it	Click "Approve and run workflows" once per Copilot review	Friction, but GitHub remembers the approval for subsequent Copilot-triggered runs in this repo

Decision

Going with C for now. Revisit if Copilot reviews become frequent enough that the per-PR approval click becomes annoying.

Background event mapping

• `pull_request_review` — overall review body (the text in "Review changes" → "Approve/Comment/Request changes")
• `pull_request_review_comment` — inline comments on specific code lines
• `issue_comment` — top-level PR conversation comments (always fires regardless of options A/B/C)