ci(review): advisory review posts top-level comments only (fixes the thread deadlock at the source)

[blove]

Problem

Two compounding issues with the advisory Claude review:

1. Its inline review comments create threads, and the branch rule "Require conversation resolution before merging" blocks auto-merge on any unresolved thread — regardless of the posting check being non-required.
2. The auto-resolve step (ci: auto-resolve advisory Claude-review threads so they don't block merge #262) is broken: the workflow GITHUB_TOKEN gets FORBIDDEN: Resource not accessible by integration on the resolveReviewThread mutation. It was never exercised until #289 (its own PR had no inline comments), where every review round re-deadlocked the merge — 3 rounds, 11 threads resolved by hand.

Fix — kill the deadlock at the source

The bot now posts one top-level comment per review (gh pr comment), never inline review threads:

• findings reference path/file.ts:123 in the comment body (still easy to locate),
• ordered most-severe first; re-reviews cover only what changed,
• the inline-comment MCP tool is removed from allowedTools, and the dead auto-resolve step is deleted.

No threads → nothing to resolve → conversation-resolution can never deadlock on the bot. Human review threads are unaffected (and still gate merge, as intended).

Review quality is unchanged — on #289 it caught two real bugs (a production shutdown container leak and a Docker writeFile parent-dir gap). Only the delivery mechanism changes.

Self-test

pull_request runs use the PR head's workflow, so this PR's own review should arrive as a single top-level comment with zero inline threads.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dawnai	Ready	Preview, Comment	Jul 6, 2026 2:38pm

[github-actions]

Automated approval: this PR received an intelligent (AI) code review. See the review comments on this PR.

[github-actions]

Claude finished @blove's task in 38s —— View job

---

Review

This is a clean, well-reasoned fix. The diff removes the broken auto-resolve step and the inline-comment MCP tool, and updates the prompt to instruct the bot to post a single top-level comment. No correctness bugs, security issues, or type-safety problems found.

One note worth validating:

.github/workflows/claude-review.yml:71

--allowedTools "Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

The prompt now tells the bot to call gh pr comment (write a new comment each run) rather than edit an existing one. The instruction "if a prior review comment of yours exists … post a fresh comment covering only what changed" will accumulate one new comment per review round. That's intentional per the PR description, but worth confirming it doesn't produce noisy comment threads on long-running PRs. Not a bug — just a UX trade-off to be aware of.

Everything else looks good:

• Removal of the dead resolveReviewThread step is correct; the GITHUB_TOKEN genuinely cannot call that mutation.
• The mcp__github_inline_comment__create_inline_comment tool is properly absent from allowedTools, so inline thread creation is blocked at the tool level rather than relying solely on prompt instructions.
• The pull_request trigger (not pull_request_target) is preserved, keeping ANTHROPIC_API_KEY safe from fork PRs.

Looks good to merge.

---