[Tooling] Secure Claude workflows

[iangmaia]

Summary

• Allow @claude review comments only from trusted commenters and skip Claude workflows on fork/external PRs before checkout or Claude execution.
• Pin mutable action references and preserve the Claude action's required OIDC permission for GitHub App token exchange.
• Keep review feedback inline-only where the workflow does not grant issue-comment permissions.

[wpmobilebot]

XCFramework Build

This PR's XCFramework is available for testing. Add the following to your Package.swift:

.package(url: "https://github.com/wordpress-mobile/GutenbergKit", branch: "pr-build/533")

_{Built from efe6030}

[Copilot]

Pull request overview

This PR hardens the claude-review GitHub Actions workflow by preventing Claude from running (and preventing checkout) on fork/external PRs, while also pinning action references and limiting review output to inline comments only.

Changes:

• Added a “PR origin” check via gh api and gated both checkout and Claude execution to internal PRs only.
• Pinned actions/checkout and anthropics/claude-code-action to immutable commit SHAs and disabled credential persistence on checkout.
• Removed top-level PR comment tooling/instructions so the workflow stays inline-only when issue-comment permissions aren’t granted.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.