Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/actions/classify-complexity/action.yml:
- Around line 62-72: The jq extraction is querying the wrong key and silencing
errors: update the CLASSIFICATION extraction to read from RAW's structured
output (use .structured_output.classification // empty) instead of .result |
fromjson? | .classification, and stop discarding stderr so failures surface
(remove or redirect the 2>/dev/null suppression for the claude call and/or log
RAW when CLASSIFICATION is empty); locate the RAW assignment and the
CLASSIFICATION parsing lines to apply these changes (references: RAW variable,
CLASSIFICATION variable, the jq expression and the --json-schema/--output-format
json flags).

In @.github/workflows/claude-comments.yml:
- Around line 32-35: Summary: The checkout step uses actions/checkout@v6 without
a ref, so on issue_comment events it checks out the default branch instead of
the PR head. Fix: modify the "Checkout repository" step that uses
actions/checkout@v6 to explicitly fetch the PR head by adding a ref and full
fetch (e.g. ref: ${{ github.event.pull_request.head.ref || github.head_ref ||
github.sha }} and fetch-depth: 0) so the job sees PR files; this preserves
current classifier behavior but prevents future steps (like the classifier step)
from accidentally analyzing the default branch instead of the PR head.
- Around line 13-15: The concurrency group currently named with the pattern
claude-comments-${{ github.event.issue.number ||
github.event.pull_request.number }}-${{ github.event.comment.id ||
github.event.review.id || github.run_id }} doesn't coordinate with the other
workflows; update the concurrency.group to use the same claude-pr-<branch> key
the other two workflows use (i.e., align with the claude-pr-${{ head.ref /
workflow_run.head_branch }} convention used in claude-improvement.yml and
claude-healing.yml) or, at minimum, remove the per-comment unique id so the key
is per-PR (PR number or resolved head branch) to ensure serialization against
improvement/healing runs and against other comment-triggered runs.

In @.github/workflows/claude-healing.yml:
- Around line 48-53: The checkout step uses fetch-depth: 10 which can be too
shallow for the rebase flow; change the actions/checkout usage to use
fetch-depth: 0 (or remove the fetch-depth key) so the full history is fetched,
or alternatively add a pre-rebase step that runs git fetch --unshallow (or git
fetch --deepen) before the git fetch origin && git pull --rebase origin
$HEAD_BRANCH command to ensure a proper merge base; update the Checkout PR
branch action configuration (the actions/checkout@v6 step and its fetch-depth
setting) or add the unshallow fetch step accordingly.
- Around line 3-6: The workflow_run trigger is referencing workflows: [CI],
which doesn't exist so the trigger is inert; update the workflow_run definition
in the YAML (the on: workflow_run block) to use the actual upstream workflow
name (replace workflows: [CI] with workflows: [Tests] or the correct name such
as "Tests") so the workflow_run will match the upstream workflow's name field
and fire when that workflow completes.

In @.github/workflows/claude-improvement.yml:
- Around line 7-12: The comment mentioning the sibling workflow incorrectly
names it "claude-watcher"; update the comment in claude-improvement.yml (the
block around the concurrency: group using claude-pr-${{
github.event.pull_request.head.ref }}) to reference the actual sibling workflow
filename `claude-healing.yml` and/or its `name: "Claude CI Watcher"`, or
alternatively rename the sibling workflow to match the comment; ensure the text
and any other mentions (e.g., the prompt near Line 98) consistently use the same
filename/name so repo-wide greps and future maintainers are accurate.

---

Nitpick comments:
In @.github/actions/classify-complexity/action.yml:
- Around line 31-37: The "Install Claude CLI" step currently pipes curl | bash
(curl -fsSL https://claude.ai/install.sh | bash) which is a supply-chain risk;
change the step to either (A) download the installer to a file, verify a pinned
checksum/signature before executing, and only then run it, or (B) remove the
inline installer and make the step fail fast if command -v claude returns false
so the runner image must include claude; update the step around the existing
command check (command -v claude) and the install invocation to implement one of
these hardened approaches and reference the same step name ("Install Claude
CLI") and installer URL when adding the checksum/verification logic.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/tests.yml:
- Line 25: The workflow pins docker/build-push-action to an old commit
("docker/build-push-action@1104d471...") which is several major versions behind;
update the uses entry for docker/build-push-action to the latest v6.x release
tag and its corresponding commit SHA (pin the SHA instead of just the tag) and
likewise update docker/setup-buildx-action to the current vX release tag and SHA
so BuildKit/cache fixes are included; locate the two uses lines (the "uses:
docker/build-push-action@..." and "uses: docker/setup-buildx-action@..."
entries) and replace them with the latest stable v6 (for build-push-action) and
matching setup-buildx-action releases, ensuring cache-from/cache-to settings
remain unchanged.