test: sample program to exercise CI/CD code review stage

[yashrajsapra]

What this tests

Exercises the generic CI/CD pipeline end-to-end on a PR in this very repo.

Deliberate issues planted in sample/buggy_app.py

#	Issue	Type
1	Hardcoded DB_PASSWORD + API_KEY	Security — secrets
2	SQL injection in get_user()	Security — injection
3	DB connection never closed	Bug — resource leak
4	calculate_discount() returns amount not discounted price	Logic error
5	load_config() has no FileNotFoundError handling	Missing error handling
6	divide() has no zero-division guard	Bug
7	process_items() mutates list during iteration	Bug

Expected pipeline stages

• lint — flake8 style issues
• security-scan — gitleaks flags hardcoded credentials
• code-review — claude posts structured review comment on this PR

Add ANTHROPIC_API_KEY as a repo secret to enable the code-review stage.

[yashrajsapra]

Re-triggering pipeline after fixes: GH_TOKEN auth for pr-diff + gitleaks install from GitHub releases.

[github-actions]

Code Review\n\n⚠ Automated review failed to run. Please review manually.