ci: unblock AI-authored PRs (review gate + mention context) - #57

Two gaps, both preventing reviews on AI-authored PRs:

1. claude-review.yml: extend the author_association gate to also allow
   PRs opened by claude[bot] (our issue-to-PR pipeline). The old gate
   skipped the review job entirely — AI-authored code was merging with
   no review, which is the OPPOSITE of what we want. See PR #55 which
   landed unreviewed due to this.

2. claude-mention.yml: inject PR/issue number, URL, kind, commenter
   login, and the full comment body into the prompt. In the pinned
   action version the triggering comment is not reliably forwarded as
   context, so an @claude mention like "review this PR" was producing
   "I don't see a specific task in this mention, could you share the PR
   number?" — the agent had no idea which PR fired the workflow.

Gate safety: github.event.pull_request.user.login is set by GitHub's
auth system from the actual PR author. GitHub reserves the [bot] suffix
for apps and enforces globally unique app slugs, so claude[bot] is
specifically Anthropic's Claude app (which has to be installed in the
HarperFast org to open PRs here). Fork-triggered workflow runs have no
access to secrets regardless, so even a hypothetical bypass has a
read-only blast radius.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…n TODO

Review feedback on #57:

1. A single `>` markdown blockquote only marks its first line as
   quoted; subsequent lines render as plain paragraphs. For a
   multi-line @claude request the agent still reads all content, but
   the prompt's visual framing is wrong. Swap to a fenced code block
   so the entire comment body renders as quoted text regardless of
   line count.

2. Add a TODO comment near the inline-injection block so the reason
   it exists doesn't become mystery-cruft six months from now. When
   claude-code-action reliably forwards the triggering comment as the
   prompt, this wrapper can collapse back to supplemental context.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>