ci: add Claude PR review agent

[thomaspinder]

Summary

A PR comment that mentions @claude-pr-review runs a Claude reviewer agent on that PR. Text after the mention reaches the agent as extra instructions, for example @claude-pr-review focus on the kernel changes.

 .claude/
+└── agents/pr-reviewer.md      # review rules taken from AGENTS.md
 .github/workflows/
+└── claude-pr-review.yml       # issue_comment -> anthropics/claude-code-action

on PR comment
  if the comment mentions @claude-pr-review and the author is thomaspinder
    claude-code-action --agent pr-reviewer
      gh pr view, gh pr diff
      inline comment on each in-scope finding
      full review (P0/P1/P2 in-scope + out-of-scope follow-ups) in the tracking comment

The agent checks the AGENTS.md rules that ruff cannot: val() on every parameter read, no new paramax.unwrap(model) in objectives, jit/vmap/grad compatibility and dtype promotion, jaxtyping annotations, regression tests for bug fixes, warning-free tests, and py:percent notebooks.

Notes:

• The action restores .claude/ from the PR's base branch before Claude starts. A PR cannot change the instructions of its own reviewer, and changes to the agent take effect after merge.
• The run uses a Claude subscription through the CLAUDE_CODE_OAUTH_TOKEN secret. The first run needs the Claude GitHub App on this repo and that secret.
• The workflow follows zizmor.yml conventions: permissions: {} at workflow level, actions pinned by SHA, persist-credentials: false.

Evidence

• uv run --frozen --only-group dev zizmor --format sarif .github/workflows/claude-pr-review.yml: 0 results (the zizmor.yml gate).
• Local agent load check:

  claude -p --agent pr-reviewer "quote the sentence that begins 'You review pull requests for'"
    -> "You review pull requests for GPJax."
  claude -p --agent no-such-agent ...
    -> "--agent 'no-such-agent' not found."   # a missing agent fails the run, not a silent generic review
  

• Not yet run end to end on GitHub: that needs the App and the secret.

Merge Danger

Door: two-way

Delete the two files to revert.

Blast Radius: isolated

The workflow runs only on PR comments that mention @claude-pr-review and come from thomaspinder. No package code, test, docs or release workflow changes. Each run uses Claude subscription quota.

🤖 Generated with Claude Code

[github-actions]

📖 Docs preview: https://pr-807--endearing-crepe-c2d5fe.netlify.app

Smoke render — the expensive notebooks run with reduced budgets, so
figures are not publication fidelity. /render-mode.txt says smoke.