ci: run @claude on Claude subscription + harden /prompt worktree guidance

.claude/skills/prompt/references/coding-workflow.md

@@ -18,7 +18,7 @@ Higher-priority instructions and the repository's own `AGENTS.md` / `CLAUDE.md`
 - Name the branch with a short kebab-case phrase that identifies the task, following the repository's existing prefix convention when one exists.
 - Inspect first: current branch, upstream, other worktrees, and `git status`. Never assume the branch or remote.
 - Do not commit directly to a protected or base branch (`main`, `master`, `develop`, `release/*`). If you find yourself on one, create the worktree/branch above before editing.
-- If the environment already placed you in a dedicated per-task worktree on a fresh branch, use it as-is; do not nest another one.
+- If the environment already placed you in a dedicated per-task worktree, verify it before trusting it as fresh: confirm the current branch, a clean `git status`, and that its merge base matches the latest remote default branch (`git fetch` first). Use it as-is only when those checks pass; otherwise create a new worktree and branch as above. Do not nest another worktree inside a verified one.
 - Preserve unrelated staged, unstaged, and untracked work. Do not stash, reset, clean, or discard changes you did not create.
 - Commit or push only when the task explicitly asks for it. Never force-push, rebase shared history, delete branches, or merge into a base branch without explicit confirmation.
 

.github/workflows/claude.yml

@@ -49,20 +49,23 @@ jobs:
     env:
       # Assigned to job env so a step-level `if` can detect an unconfigured
       # secret and skip gracefully instead of hard-failing the check.
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      # Authenticates against a Claude subscription (Claude Code usage) rather
+      # than pay-per-use API billing. Mint it locally with `claude setup-token`
+      # and store it as the CLAUDE_CODE_OAUTH_TOKEN repository secret.
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
     steps:
-      - name: Warn when the API key is not configured
-        if: ${{ env.ANTHROPIC_API_KEY == '' }}
-        run: echo "::warning title=Claude::ANTHROPIC_API_KEY secret is not configured; skipping. Add ANTHROPIC_API_KEY (or switch the action input to claude_code_oauth_token) in repository secrets so @claude mentions are handled."
+      - name: Warn when the OAuth token is not configured
+        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN == '' }}
+        run: echo "::warning title=Claude::CLAUDE_CODE_OAUTH_TOKEN secret is not configured; skipping. Generate it with 'claude setup-token' and add it as a repository secret so @claude mentions are handled by your Claude subscription."
       - name: Checkout repository
-        if: ${{ env.ANTHROPIC_API_KEY != '' }}
+        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
       - name: Run Claude Code
-        if: ${{ env.ANTHROPIC_API_KEY != '' }}
+        if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
         uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1.0.178
         with:
           # The action's default trigger phrase is "@claude"; it reads the
           # triggering comment/review and acts on the current PR head.
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}