[blurbery]

What this changes

Adds a Claude review for pull requests (.github/workflows/claude-code-review.yml). Each PR gets one review from a single Claude Sonnet pass, which posts inline comments on real problems and a short summary comment. It reads CONTRIBUTING.md for the rules.

• Runs when a PR is opened, updated, reopened or marked ready for review, but skips once its summary comment (marked <!-- claude-review -->) exists, so each PR gets one review, including PRs that start Markdown-only and gain code later.
• Skips drafts, bot PRs, fork PRs (GitHub withholds secrets from them) and Markdown-only changes.
• Uses a CLAUDE_CODE_OAUTH_TOKEN secret so it runs on my Claude subscription rather than paid API credits. It falls back to ANTHROPIC_API_KEY only when no token is set, and does nothing at all until one of them exists.
• Read-only access to the code, write access only to PR comments, a 15-minute timeout and at most 25 turns per review. Actions are pinned to commit SHAs like the other workflows.

How I tested it

No Python changes, so the unit tests aren't affected. The workflow passes actionlint. With the token secret added, the review ran on this PR and posted its summary comment. On the matching Vivid PR (blurbery/vivid#121), a re-run skipped the review because the summary already existed.

Release notes

BEGIN_COMMIT_OVERRIDE
END_COMMIT_OVERRIDE

AI disclosure (required)

• No AI tools were used for any part of this change.
• AI tools were used for this change, as described below.

AI tools used and what they did:

I designed and directed this change (a single cheap Sonnet pass instead of the multi-agent review, running on my subscription and skipping PRs that don't need it) and used Claude Opus to help write the workflow and this description.

Checklist

• I've read CONTRIBUTING.md.
• The title follows Conventional Commits, like fix: keep posters on Jellyfin 12.
• I understand every line of this change and can explain it.
• New source files have the CineSets header, and the unit tests pass.
• Nothing private is included (server addresses, API keys, user names, logs).

[github-actions]

No problems found. Permissions, tool allowlist, SHA pinning and the credential fallback all look right.

[github-actions]

Nothing needs fixing. The workflow matches the other workflows' conventions (SHA-pinned actions, header, least-privilege permissions), and no private details are included.