feat(ci): sha-anchored review verification + drop /pr-status

[tombakerjr]

Summary

Replaces the brittle "wait after CI completion" timestamp-poll protocol with a direct SHA-match check between the latest sticky review comment and the PR head. Drops the /pr-status slash command — verification ops are now native gh commands inlined where used.

Supersedes #15 (closed — branched off stale main; this one starts from current main with broader scope including plan-execution skill updates).

Workflow changes (.github/workflows/claude-code-review.yml)

• concurrency block with cancel-in-progress: true — older in-flight reviews die when newer pushes arrive. Saves Anthropic tokens and Actions minutes on rapid-push iteration.
• Checkout pinned to pull_request.head.sha (with || github.sha fallback). Default is the synthetic merge ref — would have the model reviewing merged state while the stamp says head.
• New Compute short SHA step writes the 7-char SHA to GITHUB_OUTPUT. The prompt references it as a literal — LLM string-slicing of a 40-char hex is unreliable.
• Prompt instructs Claude to start the comment with **Reviewed commit:** <short-sha> — the anchor downstream verification keys off.
• Drop Bash(gh pr comment:*) from allowedTools — unused; the Claude GitHub App posts via its own credentials.

Drop /pr-status

• Delete commands/pr-status.md. Same reasoning that previously dropped /pr-create and /pr-merge: Claude already knows how to do these, and slash commands wrapping native ops rot.
• Update skills/plan-execution/SKILL.md FINAL section to inline the verification protocol (gh pr checks --watch + SHA-anchored sticky-comment check with null handling and 3× / 5s retry for replication lag) instead of calling /pr-status in its loop.
• Integration section updated to reference the inline ops + per-project memory.

CLAUDE.md cleanup

• Drop "readiness checks via /pr-status" from Overview.
• Drop pr-status.md from Plugin Structure; fill in the agents list (was missing implementer, quality-reviewer, quick-reviewer, spec-reviewer).
• Replace "The PR Readiness Check (Why This Matters)" section with a SHA-anchored protocol summary that points at consuming projects for project-specific bits (bot identifier, comment format, repo quirks).

Why

The prior protocol anchored on timestamp comparisons (comment.created_at > push_time or comment.updated_at >= ci.completed_at), which:

1. Silently failed under CI re-runs without a fresh push (old comment still passed the filter)
2. Was brittle under GitHub's distributed clock skew (comment posted in the same second as CI completion → ambiguous)

SHA match is direct, unambiguous, and resilient. Once the workflow stamp lands on main, downstream verification is a few lines of native gh.

Test plan

• CI passes (exercises new workflow against itself — note: the action will refuse to run the modified workflow until merged; only non-claude CI on this PR can verify)
• After merge: next PR's sticky comment shows **Reviewed commit:** <short-sha> header
• After merge: short SHA matches gh pr view --json headRefOid -q .headRefOid
• Concurrency: push a follow-up commit; older run cancels, only the latest produces a comment
• Sticky: single comment per PR, updated in place

Note

README likely has similar staleness around /pr-status references — out of scope for this PR; separate cleanup.

🤖 Generated with Claude Code

[claude]

Claude finished @tombakerjr's task in 1m 48s —— View job

---

Reviewed commit: d48106d

CONSIDER: .github/workflows/claude-code-review.yml:20 — id-token: write is present but not obviously consumed by the review action. If claude-code-action doesn't require OIDC token exchange this is overly broad. Worth confirming the action actually uses it; if not, drop it.

CONSIDER: .github/workflows/claude-code-review.yml:26 — || github.sha fallback is dead code. This workflow only triggers on pull_request events (line 4), so github.event.pull_request.head.sha is always set. Harmless, but misleading.

CONSIDER: skills/plan-execution/SKILL.md:138 — The gh api command uses $OWNER/$REPO ($VAR style) while every other placeholder in the file uses <angle-bracket> style (e.g., <pr>, <short-sha>). Mixed conventions could confuse an agent trying to interpolate the command literally. Standardise to <owner>/<repo> or note they're placeholders.