ci: install Claude Code Action workflow (@claude in issues / PRs)

[SDS-Mode]

Summary

Adds the canonical Claude Code Action workflow file. After merge, mentioning `@claude` in an issue, PR comment, or PR review triggers Claude Code with full repo context.

The auto-installer (`/install-github-app`) tried to push `.github/workflows/claude.yml` directly to `main` and was blocked by the repository ruleset:

Repository rule violations found · Changes must be made through a pull request.

This PR carries the same file the installer would have committed, so merging it completes the install.

File contents

Verbatim from `anthropics/claude-code-action/examples/claude.yml`:

• Triggers: `issue_comment`, `pull_request_review_comment`, `issues (opened/assigned)`, `pull_request_review (submitted)`
• Trigger phrase: `@claude` (in body, comment, or issue title)
• Permissions: contents/pull-requests/issues/id-token write, actions read
• Action: `anthropics/claude-code-action@v1`
• All optional knobs left as commented-out template (`trigger_phrase`, `claude_args`, `settings`)

Required after merge

Set the `ANTHROPIC_API_KEY` repository secret:

Settings → Secrets and variables → Actions → New repository secret

Without it, the workflow will fail loudly on first invocation rather than do anything dangerous.

Security note

The workflow has no `run:` blocks that interpolate untrusted input — the only step is `uses: anthropics/claude-code-action@v1`. The `contains()` calls in the `if:` expression are boolean evaluation, not shell interpolation. Safe per the GitHub Actions injection guide.

Test plan

• Workflow YAML valid (committed cleanly)
• Merge → Settings → Actions shows "Claude Code" workflow listed
• Set `ANTHROPIC_API_KEY` secret
• Comment `@claude help` on any issue → workflow runs

🤖 Generated with Claude Code