feat: auto-select LLM provider in PR review workflow

[menil]

Summary

• Updates the template's pr-review.yml to pass through the new anthropic_api_key / claude_code_oauth_token inputs added by menil/pr-code-review-action (see feat: support Claude Pro/Max OAuth token auth pr-code-review-action#26).
• provider is now computed automatically from which secrets are configured on the consuming repo: a Claude Code subscription token (CLAUDE_CODE_OAUTH_TOKEN) is preferred over a billed API key (ANTHROPIC_API_KEY) when both are set, and it falls back to openrouter when neither is set — matching the pattern already applied to pr-code-review-action's own workflow.
• Adds vars-based overrides for the Anthropic model/base URL/max tokens, mirroring the existing OpenRouter override convention.

Test plan

• YAML parses cleanly
• just validate passes (pre-commit hook also ran it automatically)
• This only takes effect for repos scaffolded/synced from this template once feat: support Claude Pro/Max OAuth token auth pr-code-review-action#26 merges to main, since the action is pinned at @main

https://claude.ai/code/session_01NBXWBSZNTfweRrPhJterDW

[github-actions]

Code Review Summary

Needs Attention (1 issue)

1. [Dependency & Deployment Safety] Action version should be pinned instead of using @main - file:.github/workflows/pr-review.yml:20
   Using menil/pr-code-review-action@main can introduce unexpected breaking changes. Consider pinning to a specific version tag (e.g., @v1.0.0) for stability and predictability in CI/CD pipelines.

Suggestions (1 item)

1. [Quality & Readability] Simplify provider selection logic (MED impact, LOW effort)
   The ternary expression on line 25 is correct but difficult to parse. Consider extracting this into a separate variable or using a more explicit conditional for clarity, especially for maintainers unfamiliar with GitHub Actions expression syntax.

All Clear

• Correctness & Logic: No bugs or edge case issues detected
• Static Analysis & Types: YAML syntax and GitHub Actions expressions are valid
• Security: No credentials hardcoded; proper use of GitHub Actions secrets handling
• PII Detection: No personally identifiable information exposed
• Test Quality: Workflow properly supports integration testing
• Backward Compatibility: OpenRouter configuration remains functional; Anthropic is purely additive

Verdict: Needs Attention

Address the action version pinning concern before merging to ensure deployment safety and prevent unexpected breakages from upstream changes.

[menil]

Thanks for the review!

• On pinning menil/pr-code-review-action to a version tag: we're intentionally staying on @main for now.
• The provider-selection ternary readability suggestion has been applied in this commit.