feat: add reusable cursor-review workflow + centralized assets

[mattmillerai]

Extracts the label-triggered multi-model Cursor review out of the private consumer repos (cloud, comfy-cloud-mcp-server) into one shared reusable workflow here — single source of truth, no per-repo drift.

Why

cursor-review was copy-ported into each consumer repo. The copies drift (e.g. the severity feature landed in cloud but not comfy-cloud-mcp-server, and a verbatim re-copy then failed the consumer's markdown formatter). Centralizing ends that: consumers carry only a thin caller.

What's here

• .github/workflows/cursor-review.yml — reusable workflow_call workflow. Same job graph as the private original: gate → diff-size → 8-cell panel (4 labs × adversarial/edge-case) → judge consolidate → Slack start/complete DMs. Repo-specific knobs are now inputs:
  • judge_model (default claude-opus-4-7-thinking-xhigh)
  • diff_size_cap (default 5000)
  • review_label (default cursor-review)
  • diff_excludes (generic default; consumers pass their generated/vendored paths)
  • workflows_ref (which ref of this repo to load assets from)
  • secrets: CURSOR_API_KEY (required), SLACK_BOT_TOKEN (optional)
• .github/cursor-review/ — the trusted review logic: prompt-adversarial.md, prompt-edge-case.md, prompt-judge.md, extract-findings.py, post-review.py, slack-notify.sh.

Trust model (improved)

The private original git show'd the prompts/scripts from the consumer's base SHA (trusted-but-in-PR-repo). Here the workflow loads them by checking out this repo (public, pinned via workflows_ref), so a PR in the consumer repo can't influence what runs at all. The diff under review still comes from the PR head; the logic doesn't.

Severity

The bundled post-review.py + prompts include the CodeRabbit-style severity categorization (🔴 critical / 🟠 high / 🟡 medium / 🟢 low / ⚪ nit badges + a summary count table), so this is the latest version — it supersedes the in-flight per-repo severity port.

Validation

actionlint clean (exit 0); post-review.py / extract-findings.py compile.

Rollout

1. Merge this.
2. comfy-cloud-mcp-server migrates to a thin caller (separate PR, depends on this) and deletes its local copies.
3. cloud migrates next (follow-up; cloud-team review).
4. Move the floating v1 tag once reviewed so callers can pin to @v1.

🤖 Generated with Claude Code