chore: enhance Claude Code review workflow

Add Read/Glob/Grep to allowed tools, track_progress, sticky comments,
display report, actions:read permission, plugin marketplace, and
first-time contributor context. Remove redundant posting instructions
(already in code-review.md).

[ci skip]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: natemcmaster

.github/workflows/claude-code-review.yml

@@ -11,6 +11,7 @@ jobs:
       contents: read
       pull-requests: write
       id-token: write
+      actions: read
 
     steps:
       - name: Checkout repository
@@ -23,17 +24,27 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          track_progress: true
+          use_sticky_comment: true
+          display_report: true
+          additional_permissions: |
+            actions: read
+          plugin_marketplaces: "https://github.com/anthropics/claude-plugins-official.git"
           plugins: "code-review@claude-plugins-official"
           prompt: |
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}
 
+            CONTRIBUTOR: ${{ github.event.pull_request.user.login }}
+            CONTRIBUTOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+
             Read .claude/commands/code-review.md and follow its instructions to review PR ${{ github.event.pull_request.number }}.
 
             Note: The PR branch is already checked out in the current working directory.
 
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` (with `confirmed: true`) to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
+            If CONTRIBUTOR_ASSOCIATION is FIRST_TIME_CONTRIBUTOR or NONE, this is a new contributor.
+            Be extra welcoming, but also be thorough — check for compliance with project coding standards,
+            proper test coverage, and any breaking changes. Help them understand project conventions
+            rather than just pointing out issues.
 
-          claude_args: '--model opus --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"'
+          claude_args: '--model opus --allowedTools "Read,Glob,Grep,mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"'