refactor: remove automated review response workflow

[kolatts]

Summary

• remove the unreliable Claude Respond to Review workflow
• allow claude-review.yml to review Imagile Bot-created PRs only when they come from trusted same-repository claude/issue-* branches
• narrow allowed_bots from every bot to imagile-bot
• remove the obsolete github-actions[bot] self-review fallback

Why

The response workflow's only recent eligible run failed before doing work because its trigger actor was a bot; most other executions were correctly skipped. We no longer want to maintain that automated response loop.

Imagile Bot now creates triage PRs, so the review workflow author gate must recognize imagile-bot[bot]; otherwise those PRs silently skip review.

Validation

• both remaining Claude workflow YAML files parse successfully
• git diff --check
• repository-wide search confirms no stale claude-respond references

Follow-up to #289 and #290.

[github-actions]

Claude finished @kolatts's task in 1m 42s —— View job

---

PR Review

• Gather context and read changed files
• Clean up previous Claude comments (skipped — gh api not in allowedTools)
• Review PR changes
• Post formal review — Approved

---

Summary: Clean, well-scoped removal. No substantive issues found.

claude-respond.yml deletion — justified. The workflow's guard rails (2-run cap, claude/issue-* branch restriction, fork check) were well-designed, but if the trigger actor being a bot caused the only eligible run to abort pre-work, maintaining it isn't worth the complexity and failure surface.

claude-review.yml changes — all three logic changes are improvements:

1. contains(..., 'claude') → == 'claude[bot]': Exact match is strictly safer. The substring check would have matched any future bot whose name happened to include "claude".

2. github-actions[bot] → imagile-bot[bot] in the branch-gated arm: Correct follow-up to fix: create triage PRs as Imagile Bot #290. The branch guard (claude/issue-*) is still in place, so this only widens trust to Imagile Bot on the specific branch pattern — not generally.

3. allowed_bots: '*' → 'imagile-bot': Narrowing from wildcard to a named identity is the right call.

4. Removing the github-actions[bot] self-review prompt exception: Dead weight — that case can no longer occur after change chore(main): release 1.0.0 #2.

One observation (not blocking): REVIEW ACTOR on line 70 still emits github-actions[bot] when the review workflow file itself changes. This is still correct — it describes the token identity in use, not the removed self-review exception. No action needed.

[github-actions]

Clean, well-scoped removal. A few notes from the review:

claude-respond.yml deletion — justified. The workflow's guard rails (2-run cap, claude/issue-* branch restriction, fork check) were well-designed, but if the trigger actor being a bot caused the only eligible run to abort pre-work, maintaining it isn't worth the complexity and failure surface.

claude-review.yml changes — all three logic changes are improvements:

1. contains(..., 'claude') → == 'claude[bot]': Exact match is strictly safer. The substring check would have matched any future bot whose name happened to include claude.

2. github-actions[bot] → imagile-bot[bot] in the branch-gated arm: Correct follow-up to #290. The branch guard (claude/issue-*) is still in place, so this only widens trust to Imagile Bot on the specific branch pattern — not generally.

3. allowed_bots: '*' → 'imagile-bot': Narrowing the action's bot allowlist to a named identity is the right call. Wildcard here was always broader than needed.

4. Removing the github-actions[bot] self-review prompt exception: This was load-bearing only for the case where both PR author and reviewer were github-actions[bot]. That case can no longer occur after #2 above, so the exception was dead weight in the prompt.

One observation (not blocking): REVIEW ACTOR on line 70 still emits github-actions[bot] when the review workflow file itself changes. This is still correct — it describes the token identity in use, not the removed self-review exception. No action needed, but worth noting for anyone who reads the prompt later.

[github-actions]

Claude finished @kolatts's task in 1m 19s —— View job

---

PR Review

• Gather context and read changed files
• Clean up previous Claude comments (skipped — gh api not in allowedTools)
• Review PR changes
• Post formal review — Approved (PR already merged; formal review not applicable)

---

Summary: Clean, well-scoped removal. No substantive issues found.

claude-respond.yml deletion — justified. The workflow's guard rails (2-run cap, claude/issue-* branch restriction, fork check) were well-designed, but if the trigger actor being a bot caused the only eligible run to abort pre-work, maintaining it isn't worth the complexity and failure surface.

claude-review.yml changes — all three logic changes are improvements:

1. contains(..., 'claude') → == 'claude[bot]': Exact match is strictly safer. The substring check would have matched any future bot whose name happened to include "claude".

2. github-actions[bot] → imagile-bot[bot] in the branch-gated arm: Correct follow-up to fix: create triage PRs as Imagile Bot #290. The branch guard (claude/issue-*) is still in place, so this only widens trust to Imagile Bot on the specific branch pattern — not generally.

3. allowed_bots: '*' → 'imagile-bot': Narrowing from wildcard to a named identity is the right call.

4. Removing the github-actions[bot] self-review prompt exception: Dead weight — that case can no longer occur after change chore(main): release 1.0.0 #2.

One observation (not blocking): REVIEW ACTOR on line 70 still emits github-actions[bot] when the review workflow file itself changes. This is still correct — it describes the token identity in use, not the removed self-review exception. No action needed.