ci(guardian): a reusable review workflow other repositories call #739

Guardian runs only in this repository's guardian.yml. To review PRs in other repositories (Ownima/owner-api, owner-admin, ansible), the review job moves into a reusable workflow (on: workflow_call). Each repository then carries a small caller.

The reusable workflow takes these inputs:

• pr_number;
• source_root, the directory to ingest;
• runner, a JSON runs-on;
• tooling_ref, the codegraph-brain commit whose tooling runs;
• save_metrics.

It keeps #731's shape: tooling from a pinned ref, and the PR as data in pr/. It also keeps #734's app token. On a private repository the PR checkout and the base fetch use the caller's GITHUB_TOKEN.

Done when:

• this repository's guardian.yml is a caller of the reusable workflow, and its save-metrics and rate jobs are unchanged;
• the workflow tests pin both files;
• a caller in another repository can review one of its PRs.

🤖 Generated with Claude Code