ci(claude-review): harden review workflow against Dependabot-controlled content

[frankbria]

Follow-up from PR #870, which added allowed_bots: "dependabot[bot]" so Dependabot PRs get reviewed. The cross-family review (opencode/GLM) raised two non-blocking security suggestions worth addressing now that the review bot processes upstream-controlled content.

Context

Reviewing Dependabot PRs newly exposes the Claude review step to attacker-influenced text (dependency release notes / changelogs in PR bodies). Blast radius is limited today — the job's permissions are read-only (contents/pull-requests/issues: read) and a human is always the merge decision-maker — so this is hardening, not an active vuln.

Suggested changes (.github/workflows/claude-code-review.yml)

1. Prompt-injection guard: add an explicit clause instructing the reviewer to treat the PR description, commit messages, and dependency release notes as UNTRUSTED data and never follow instructions embedded in them. Optionally set exclude_comments_by_actor: "dependabot[bot]" so Claude sees the diff but not the bot's prose.
2. Drop unused id-token: write (line ~20): the step authenticates via claude_code_oauth_token, not OIDC federation, so this permission is unused and can be removed to shrink the surface.

Notes

• Pre-existing/accepted-by-design given read-only perms; not a merge blocker for ci(claude-review): allow dependabot PRs in Claude Code Review #870.
• Reference: opencode cross-family review on PR ci(claude-review): allow dependabot PRs in Claude Code Review #870 (comment ci(claude-review): allow dependabot PRs in Claude Code Review #870 (comment)).