fix(claude-review): opt in to fork PR-head checkout for actions/checkout v7 (#122)

actions/checkout v7 (bumped in #116) refuses to check out fork pull request code from a workflow_run job unless the step opts in, so every fork PR review fails at the PR-head checkout. The step only reads the code, never runs it, persists no credentials, and strips symlinks afterwards.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>

Author: crowecawcaw

.github/workflows/reusable_claude_pr_review.yml

@@ -242,6 +242,9 @@ jobs:
           persist-credentials: false
           submodules: false
           fetch-depth: 0
+          # checkout v7 refuses fork code under workflow_run without this opt-in.
+          # Safe here: the code is only read, never run, and no token persists.
+          allow-unsafe-pr-checkout: true
 
       # Remove any symlinks from the checkout so the agent's read tools can only
       # see files inside pr-head/.