fix: restore allowedTools with posting tools, fix review workflow

[toolpathguy]

Summary

Fixes the Claude PR review workflow which was burning through its turn budget without posting any comments.

Root cause

In automation mode, Claude must explicitly post via gh pr comment and the mcp__github_inline_comment__create_inline_comment MCP tool. PR #7 removed the --allowedTools flag entirely, which meant the action's SDK treated the tool list as unrestricted but Claude Code's internal permission system still denied posting tools. Claude wasted all turns retrying denied actions.

Changes

1. .github/workflows/claude-review.yml — Complete rewrite:

   • Restored --allowedTools with the correct posting tools: mcp__github_inline_comment__create_inline_comment, Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*), Bash(gh pr checks:*)
   • Removed synchronize trigger (reviews on open/ready only — reduces cost)
   • Review job runs parallel to CI, not after it
   • --max-turns 12 (tight budget forces efficiency)
   • Prompt instructs Claude to post inline comments as it finds them and one summary at the end

2. .claude/settings.json — Stripped to read-only permissions (no Write/Edit/MultiEdit — a reviewer must not have those)

3. .kiro/steering/AI-MAP.md — Decisions Log entry recording the posting mechanism and trigger changes

What was tested

• YAML validated with a parser (no syntax errors)