ci: scope auto-review to PR submission events (drop synchronize)

.github/REVIEW_GUIDELINES.md

@@ -1,8 +1,11 @@
 # Review Guidelines — agentkeys
 
 This is the single source of truth for code review patterns in this repo. The
-`claude-code-review.yml` workflow points Claude at this file; human reviewers
-should also use it as a checklist.
+[`claude-code-review.yml`](workflows/claude-code-review.yml) workflow points
+Claude at this file on PR *submission* events (`opened`, `ready_for_review`,
+`reopened`) — NOT on every push, to cap token cost. Human reviewers should
+use it as a checklist, and `@claude`-invoked reviews
+(see [`claude.yml`](workflows/claude.yml)) pick it up when relevant.
 
 Background: these patterns were distilled from 15+ PR review cycles in
 March-April 2026 where codex repeatedly surfaced the same classes of bug. Each

.github/workflows/claude-code-review.yml

@@ -2,7 +2,14 @@ name: Claude Code Review
 
 on:
   pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
+    # Run only on PR submission events — NOT on every push (`synchronize`).
+    # `opened`        — first PR submission
+    # `ready_for_review` — draft promoted to ready (effectively a submission)
+    # `reopened`      — closed PR reopened
+    # Subsequent pushes to the PR branch are intentionally NOT reviewed, to
+    # cap Claude usage cost. Re-trigger manually by closing + reopening the
+    # PR, or by `@claude review` mention (handled in claude.yml).
+    types: [opened, ready_for_review, reopened]
     # Run only on paths that contain real code or CI config.
     # Pure docs pushes (`docs/**`, including `docs/wiki/**`) don't need a full code review
     # — they go through normal PR approval. This also skips Cargo.lock-only