[IM-3530] Make claude-review.yml reusable and configurable

[gobetti]

Summary

• Adds extra_prompt, timeout_minutes inputs so callers can customize behavior without forking the workflow
• Embeds a full, generic review rubric (security, compliance, data/migrations, performance, testing, APIs, dependencies) — platform/framework-specific content removed to keep it repo-agnostic
• Adds use_sticky_comment: true for a single updating PR comment
• Removes github_token so comments are posted by the Claude bot instead of the GitHub Actions bot

Adoption

Repos with an existing standalone claude.yml can replace it with:

name: Claude Code – PR Review
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
jobs:
  review:
    uses: isapp/.github/.github/workflows/claude-review.yml@main
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    with:
      max_turns: 25        # default: 15
      timeout_minutes: 25  # default: 15
      extra_prompt: |      # default: "" (nothing appended)
        ## Repo-Specific Rules
        - Example rule A

Test plan

• Merge this PR, then update a repo (e.g. ht-android) to use the reusable workflow
• Open a test PR in that repo and verify Claude bot posts a single sticky comment
• Verify extra_prompt content appears in the review output

🤖 Generated with Claude Code

---

📝 Auto-filled