ci: pin claude-code-action to v1.0.107 (#696)

## Summary

- `anthropics/claude-code-action@v1` (rolling tag) auto-pulled
**v1.0.108** at 2026-04-28 00:32 UTC and the new release regresses
OAuth-token auth — the agent SDK throws `Could not resolve
[authentication]` from `validateHeaders` before any work runs.
Refreshing `CLAUDE_CODE_OAUTH_TOKEN` does **not** help.
- Pin `.github/workflows/claude.yml` to the v1.0.107 SHA
(`7eab1296cc65117d50ac2a2fa5f00a30ec84d3d5`) until upstream ships a fix.
Inline comment notes when to lift the pin.

## Evidence

| Time (UTC) | Event |
| --- | --- |
| 2026-04-28 00:32:48 | `claude-code-action` v1.0.108 released; `v1` tag
updated |
| 2026-04-28 00:28 | last successful `@claude` run (still on v1.0.107) |
| 2026-04-28 00:41 → | every run fails with the same SDK auth error |

Failing run after rotating the OAuth token:
https://github.com/bootjp/elastickv/actions/runs/25039054927

Stack tail (same on all failing runs):

```
SDK execution error: 54 | new Anthropic({ apiKey, dangerouslyAllowBrowser: true });
... validateHeaders({values, nulls}){ ... throw Error('Could not resolve [authentication]')
##[error]Action failed with error: SDK execution error: Error: Claude Code process exited with code 1
```

The `git hash-object 'adapter/sqs_*.go' ...` warnings earlier in the
same logs are unrelated noise — the action runs `git hash-object` on
PR-only files before checking out the PR branch; they don't fail the
run.

## Test plan

- [ ] After merge, trigger `@claude` on any PR and confirm `Run Claude
Code` succeeds (currently 100% failure rate on `@v1`).
- [ ] Once upstream ships a fix (probably v1.0.109+), revert the pin
back to `@v1` in a follow-up.

## Self-review

Single-line `uses:` change in a CI workflow; the 5-lens review collapses
to: no data-loss / concurrency / consistency surface, no perf impact, no
test coverage applicable. The change is reversible by editing one line.

Author: bootjp

.github/workflows/claude.yml

@@ -32,7 +32,12 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        # Pinned to v1.0.107 because v1.0.108 (auto-pulled via the `v1` rolling
+        # tag on 2026-04-28) regressed OAuth-token auth: the agent SDK throws
+        # `Could not resolve [authentication]` from validateHeaders before any
+        # work runs. Refreshing CLAUDE_CODE_OAUTH_TOKEN does not help. Bump back
+        # to `@v1` once upstream ships a fix.
+        uses: anthropics/claude-code-action@7eab1296cc65117d50ac2a2fa5f00a30ec84d3d5 # v1.0.107
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}