Add reusable ai-guarded-review workflow

[jolelievre]

Questions	Answers
Branch?	master
Description?	Add a new reusable workflow ai-guarded-review.yml that combines guard checks, Claude review execution, validation, and label management into a single callable workflow. This replaces the previous ai-prereview-guard.yml which only handled the guard.
Type?	new feature
Category?	CO
BC breaks?	no
Deprecations?	yes — ai-prereview-guard.yml is superseded by this workflow (kept for now for backward compatibility)
How to test?	1. Merge this PR and the companion PR on ps_apiresources 2. On a test PR in ps_apiresources, add the Need AI review label as a team member 3. Verify the full flow: guard passes, Claude posts a review, labels are updated 4. Test with a non-team-member: verify guard fails with error and trigger label is removed 5. Test on an already-reviewed PR: verify it skips early
UI Tests
Fixed issue or discussion?	Related to PrestaShop/PrestaShop#41245
Related PRs	Companion PR on ps_apiresources
Sponsor company	PrestaShop SA

Details

Reusable workflow ai-guarded-review.yml

Combines all the logic that was previously split between ai-prereview-guard.yml and each consumer's workflow into a single reusable workflow. Consumer repos only need to handle event triggering, code change detection, and prompt loading.

Inputs:

• team-slug, actor, pr-number, repository — guard configuration
• prompt — the review prompt content (loaded by the caller)
• trigger-label (default: Need AI review) — removed on completion or guard failure
• reviewed-label (default: AI reviewed) — added after successful review
• claude-model (default: claude-sonnet-4-6) — customizable per repo
• max-turns (default: 30) — customizable per repo
• allowed-tools (default: Read,Glob,Grep,LS,WebFetch,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)) — customizable per repo

Secrets: org-read-token, github-token, anthropic-api-key

Jobs:

1. check-label — skip if already reviewed
2. check-membership — verify actor is in the required team (with debug output)
3. gate — evaluate combined result
4. guard-failed — remove trigger label and fail with error
5. ai-review — run Claude, validate execution, update labels, post summary