ci: add Cloudflare AI Gateway PR review via central workflows

[mr-vara]

• Add ai-code-review.yml calling newfold-labs/workflows reusable workflow
• Disable automatic Claude Code Review job (if: false) for backup use

[github-actions]

AI code review

✅ Strengths

• Scoped permissions by default (permissions: {}) with explicit job-level grants; good security hygiene.
• Concurrency group and cancel-in-progress to avoid duplicate runs per branch/PR.
• Safe execution guard for drafts and forks to prevent secret exposure.
• Clear header comments documenting required secrets/variables and pinning guidance; prompts_ref aligns with the chosen ref.
• Uses central reusable workflow, reducing duplication and keeping model/prompt logic in one place.

⚠️ Suggestions (non-blocking)

• Pin the reusable workflow to a commit SHA (rather than @main) for stronger supply-chain guarantees; keep prompts_ref aligned with that same SHA tag.
• Consider adding job-level timeout-minutes and/or continue-on-error: true so transient AI/Gateway outages don’t block merges.
• If you want AI reviews on forks (external or internal), consider a pull_request_target pattern with extra hardening in the called workflow; current guard is safe but skips forked PRs entirely.
• Optionally add paths or paths-ignore filters (e.g., skip docs-only changes) to reduce run volume and cost.
• Double-check the org/repo variable CLOUDFLARE_AI_GATEWAY_ID is configured; the central workflow likely depends on it to hit the correct Gateway.
• Add a brief note in docs (e.g., docs/ci.md or contributor docs) describing this AI review workflow and how it updates a single sticky PR comment.

❌ Issues / risks

• No blocking bugs spotted in the workflow itself. Primary risks are supply-chain pinning (@main) and potential CI flakiness if the AI/Gateway is down; both have straightforward mitigations above.

Verdict

⚠️ Verdict: Looks good to merge with minor follow-ups (pin reusable workflow to a SHA, consider timeout/continue-on-error, and verify CLOUDFLARE_AI_GATEWAY_ID is set).

[github-actions]

Coverage: Base 32.94% → PR 32.94% (must not decrease).
✅ No decrease.

project coverage report 32.94% @ 37f5fa9