ci: pass GitHub identity to Claude action

[0xBreadguy]

Summary

• Forward the optional github_identity_token to both Claude analysis attempts as github_token.
• Preserve Claudes default OIDC behavior when callers omit the custom identity token.
• Add regression coverage and document the authentication behavior.

Root cause

The PR review workflow already creates a MegaETH CI App token for review publication and thread resolution.
The nested anthropics/claude-code-action calls did not receive that token, so they attempted a separate Claude GitHub App OIDC exchange.
That exchange returns 401 Unauthorized - Invalid OIDC token for the current pull_request_target workflow.

Impact

When github_identity_token is configured, the semantic analysis stage uses the same GitHub identity as the deterministic prepare and publish stages.
Model authentication continues to use claude_code_oauth_token.

Callers that omit github_identity_token continue using the Claude actions default GitHub authentication path.

Validation

• python3 .github/actions/claude-pr-review/test_review_pipeline.py — 77 tests passed
• npx --yes prettier@3.8.5 --check .github/actions/README.md .github/actions/claude-pr-review/action.yml
• git diff --check

Rollout note

This PRs own Claude review may reproduce the existing failure because the workflow intentionally loads claude-pr-review@main.
After this change merges, rerun the failed review on PR #102 to validate the live token path.

[mega-maxwell]

Claude review status

Living comment — rewritten in place. The review workflow keeps this single comment up to date instead of posting a new one each round, so it always describes the latest reviewed commit and the earlier text is intentionally gone. No reply is needed here; answer findings and questions in the review threads it links to.

🛠️ Review did not finish

Attempted head 0aa6c8c4 · updated 2026-08-19T19:55:58+00:00

This round did not publish: MODEL_ACTION_FAILED in phase review_retry. Anything listed below is from the last round that did. Re-run the workflow or push a new commit to try again.