Fix Claude Code review allowedTools to accept flags

[syed-ahsan-ishtiaque]

Summary

• Adds trailing wildcards (*) to the Claude Code review allowedTools patterns so gh pr diff NNN and gh pr view NNN commands with flags (e.g. --json, --web) are still allowed
• Without the wildcard, Bash(gh pr view 394) only matched the literal string gh pr view 394 and would deny any invocation with flags like gh pr view 394 --json number,title,..., causing Claude to burn through turns on repeated permission denials until hitting the 15-min timeout

Security

Trailing wildcard is still scoped to the current PR number via ${{ github.event.pull_request.number }}, so Claude cannot access other PRs. For example Bash(gh pr view 394*) matches gh pr view 394 --json ... but NOT gh pr view 391.

Test plan

• Verify Claude review runs complete faster (not hitting timeout) on new PRs
• Verify Claude still cannot read/post to other PR numbers

[github-actions]

Targeted fix — the trailing wildcard entries address the real problem (exact-match denying flagged invocations). Two observations inline on the changed line.