fix(ci): post Claude review via GITHUB_TOKEN instead of failing OIDC (#703)

The Claude Review workflow passed anthropic_api_key but no github_token, so
claude-code-action fell through to minting a GitHub App token via OIDC
(setupGitHubToken → getOidcToken). That path needs the Claude GitHub App
installed on the repo and failed on every PR with "Could not fetch an OIDC
token", so the advisory review never ran.

Pass github_token: ${{ secrets.GITHUB_TOKEN }} (mapped to OVERRIDE_GITHUB_TOKEN
by the action), which skips OIDC and posts review comments using the
workflow's own token — the job already has pull-requests: write. Drop the now
-unused id-token: write permission.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: blove

.github/workflows/claude-review.yml

@@ -18,8 +18,7 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
-      pull-requests: write
-      id-token: write # claude-code-action mints its GitHub token via OIDC
+      pull-requests: write # posts review comments via the default GITHUB_TOKEN
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -30,6 +29,11 @@ jobs:
         uses: anthropics/claude-code-action@806af32823ef69c8ef357086c573a902af641307 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Post as the workflow's own GITHUB_TOKEN. Without this the action
+          # falls back to minting a GitHub App token via OIDC, which requires
+          # the Claude GitHub App installed on the repo and fails otherwise
+          # ("Could not fetch an OIDC token").
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           track_progress: true
           prompt: |
             REPO: ${{ github.repository }}