fix(ci): surface Claude issue-worker replies via tracking comment

[Hmbown]

Summary

Follow-up to #4537 from live verification on #4542: the authorize gate, OIDC/app-token exchange, and the Claude session all worked (1 turn, success), but the reply was invisible — agent mode with display_report: false and a cargo/npm-only tool allowlist has no tool that can write back to the issue.

track_progress: true forces tag mode for the issue_comment event: the action maintains a tracking comment on the triggering issue (via its app token) carrying progress and the final report. No tool-allowlist widening; all other safety properties (exact @claude gate, maintainer-only, no PR comments, signed branch from main, no auto-PR) unchanged.

Verification plan after merge

Re-run the plan-only test on #4542 and confirm the tracking comment appears with the plan.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude finished @Hmbown's task in 1m 1s —— View job

---

Review: fix(ci): surface Claude issue-worker replies via tracking comment

• Gather context (diff, full claude.yml, and claude-review.yml for precedent)
• Understand the request (code review of the workflow diff)
• Analyze correctness/safety of track_progress: true
• Post review feedback

Summary

This is a minimal, well-scoped fix (+4/-0) to .github/workflows/claude.yml. Root cause matches the PR description: with display_report: false and an allowedTools list restricted to cargo/npm shell commands, agent mode has no tool that can write the reply anywhere — the run succeeds but is invisible. Setting track_progress: true switches to tag mode, which maintains a tracking comment via the job's app token, independent of --allowedTools.

Verified this isn't a new pattern: .github/workflows/claude-review.yml:49 already sets track_progress: true for the PR-review workflow (in fact, that's the exact mechanism producing this comment). So this change brings the issue-worker workflow in line with existing, already-trusted repo precedent rather than introducing a new capability.

Safety properties confirmed unchanged

• No permission escalation: the job already has issues: write (claude.yml:54), which is what a tracking comment needs — no contents/pull-requests scope added.
• No allowedTools widening: claude_args (claude.yml:96-97) is untouched; the tracking-comment tool is part of tag-mode's built-in surface, not the user-configurable --allowedTools.
• PR bleed-through still blocked structurally, not just by convention: the authorize job's gate (claude.yml:36) requires !issue.pull_request, so this workflow only ever runs for true issues regardless of track_progress.
• Maintainer-only / exact-mention gate (claude.yml:32-39) is untouched by this diff.

Notes

• No correctness bugs — single added line plus a comment, straightforward YAML, no syntax issues.
• No test suite coverage for this, but that's expected/reasonable for a GitHub Actions config change; the PR's stated verification plan (re-run the plan-only test on test: verify Claude issue worker end-to-end (docs-only) #4542 post-merge) is the right way to confirm this class of fix.
• Not applicable: provider/model routing invariant (this diff doesn't touch model/provider selection code).

No blocking issues found. This looks safe to merge, with the noted post-merge live verification on #4542.