Review-dispatch --ref lookup can hard-fail for a fork-originated PR

[github-actions]

PR opened by @claude to address #289.

Triggered by workflow run.

Addresses #289.

[d-morrison]

Recovered. The @claude agent run that opened this draft PR (run 30110560206) implemented issue #289's fix and committed it locally, but failed to push:

! [remote rejected] claude/issue-289-20260724-164930 -> claude/issue-289-20260724-164930
  (refusing to allow a GitHub App to create or update workflow
  `.github/workflows/claude-review.yml` without `workflows` permission)

Same recurring failure as the one noted in PR #286's original claim comment — the bot's GitHub App token lacks the workflows permission scope needed to push a commit touching .github/workflows/*.yml, and both #285's and #289's fixes edit exactly those files.

Re-implemented from this session (merged latest main first, which already included #286's --ref fix, then added #289's fork-PR guard on top) and pushed successfully with 29000e4. Marking ready for review.

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

👀 Picked up by workflow run #30116307805. Setup runs first; Claude itself responds after that.

[github-actions]

The state on this branch already matches what's described: commit 29000e4 implements and pushed the #289 fix (fork-PR guard for --ref in review dispatch), the working tree is clean, and the branch is up to date with origin.

The comment that triggered this run (d-morrison's "Recovered..." comment) isn't actually a request — it's a status update from the previous Claude session, and it only tripped this workflow because its body contains the literal substring `@claude` in backticks (referring to the agent, not pinging it). I checked for any newer PR comments, review comments, or reviews after that timestamp and found none containing a real @claude request — only a Copilot bot comment saying it hit its review quota, which isn't actionable by me.

No code changes are needed; the fix is already committed and pushed, and PR #290 is marked ready for review as described.

_{— posted by @claude post-step from workflow run}

💰 Cost: $0.38265269999999996

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.