submit_pull_request_review safe output silently fails when workflow is triggered by workflow_run (no PR context)

[Calidus]

Summary

The submit_pull_request_review safe output handler silently skips execution when the workflow is triggered by
workflow_run because there is no PR context available. The handler has no pull_request_number field in its validation
schema, unlike push_to_pull_request_branch which does.

Reproduction

1. Workflow A creates a PR and completes successfully
2. Workflow B triggers via workflow_run on Workflow A's completion
3. Workflow B's agent finds the PR, reviews it, and calls submit_pull_request_review with event and body
4. The safe outputs handler logs "No review context set - skipping PR review submission" and drops the review

Root Cause

The submit_pull_request_review validation schema only defines two fields:

  "submit_pull_request_review": {
    "fields": {
      "body": { "type": "string", "maxLength": 65000 },
      "event": { "type": "string", "enum": ["APPROVE", "REQUEST_CHANGES", "COMMENT"] }
    }
  }

The handler resolves the target PR from github.event.pull_request.number, which is only populated on
pull_request-triggered workflows. There is no way for the agent to explicitly specify which PR to review.

By contrast, push_to_pull_request_branch already supports this pattern:

  "push_to_pull_request_branch": {
    "fields": {
      "branch": { "required": true, ... },
      "message": { "required": true, ... },
      "pull_request_number": { "issueOrPRNumber": true }
    }
  }

Expected Behavior

The handler should either:

1. Accept an explicit pull_request_number field (preferred — matches push_to_pull_request_branch behavior), or
2. Resolve the PR from the branch name when target: "*" is configured and the agent provides a branch reference

Suggested Fix

Add pull_request_number: { "issueOrPRNumber": true } to the submit_pull_request_review validation schema. The handler
should use this field to target the review when no implicit PR context exists from the triggering event.

Workaround

Passing aw_context with item_type: "pull_request" and item_number via workflow_dispatch from the upstream workflow
would populate the PR context. However, this requires restructuring the trigger from workflow_run to an explicit
dispatch, which adds coupling between the two workflows.

Impact

Any workflow using submit_pull_request_review that triggers on workflow_run, schedule, workflow_dispatch (without
aw_context), or repository_dispatch will silently fail to post reviews. The agent succeeds, no error is reported, but
the review never reaches GitHub.