ci: fix Claude Code Review — always post a comment (unlock-protocol#16341)

ci: replace opaque code-review plugin with direct review prompt

The code-review plugin only posts comments when it finds issues,
making it invisible on clean code. Replace with a direct prompt
that always posts a review (LGTM or issues found). Also drops
the plugin_marketplaces dependency entirely.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: julien51

.github/workflows/claude-code-review.yml

@@ -3,21 +3,9 @@ name: Claude Code Review
 on:
   pull_request:
     types: [opened, synchronize, ready_for_review, reopened]
-    # Optional: Only run on specific file changes
-    # paths:
-    #   - "src/**/*.ts"
-    #   - "src/**/*.tsx"
-    #   - "src/**/*.js"
-    #   - "src/**/*.jsx"
 
 jobs:
   claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -36,12 +24,17 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
-          claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr review:*),Bash(gh pr view:*),Bash(git diff:*),Bash(git log:*),Bash(git show:*),Read,Glob,Grep'
-          display_report: 'true'
           use_sticky_comment: 'true'
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
+          claude_args: '--allowedTools Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr review:*),Bash(gh pr view:*),Bash(git diff:*),Bash(git log:*),Bash(git show:*),Read,Glob,Grep'
+          prompt: |
+            Review the code changes in PR #${{ github.event.pull_request.number }} of this repository.
+
+            Steps:
+            1. Run `gh pr diff ${{ github.event.pull_request.number }}` to see the changes
+            2. Run `gh pr view ${{ github.event.pull_request.number }}` to see the PR description
+            3. Review the changes for bugs, security issues, and code quality problems
+            4. Post your review using:
+               `gh pr review ${{ github.event.pull_request.number }} --comment --body "YOUR_REVIEW"`
 
+            Always post a review comment, even if the code looks good (write "LGTM" with a brief summary in that case).
+            Focus on real issues — not style nitpicks.