fix(ci): claude-pr-review self-cancels via bot status comment

[avihut]

What happens

1. Maintainer comments `/claude review` on a PR → workflow run Feature: Shorthand Remote URL Support #1 fires, action starts.
2. `claude[bot]` posts a "Claude Code is working..." status comment as the action begins.
3. That bot comment is an `issue_comment` `created` event on the same PR → workflow run Feature: Root Level .git Dir #2 is queued.
4. `concurrency` is declared at workflow level with `cancel-in-progress: true`. The new run cancels run Feature: Shorthand Remote URL Support #1 before its `if:` is evaluated.
5. Run Feature: Root Level .git Dir #2 then evaluates `if:` → comment doesn't contain `/claude review` → skipped.

Net: the bot's own progress comment cancels the bot's review. Verified on PR #438, run `25225661590` cancelled at 17:48:43Z; the cancelling event is the bot comment posted at 17:48:26Z.

Root cause

Workflow-level concurrency is evaluated before any job's `if:`. Job-level concurrency is evaluated after the `if:` — skipped jobs don't grab the slot.

Fix

Move the `concurrency` block from workflow-level to job-level on the `review` job. Bot status comments will continue to fire `issue_comment` events, but they'll be skipped by the existing `if:` and never reach the concurrency machinery.