ci: make Claude Review advisory (never block PRs)

[matthieugouel]

Problem

The Claude Review check went red on #14 with:

Claude execution failed: Reached maximum number of turns (5)

anthropics/claude-code-action exits non-zero when it hits --max-turns, and that propagates to the job — so the PR check fails even though the review ran and posted its findings. A review running out of turns is not a signal that the PR is bad, so it shouldn't block a merge.

Fix

• continue-on-error: true on the review step → the review is advisory: it still posts its comments, but neither a turn-limit stop nor any other action error turns CI red.
• --max-turns 5 → 20 so the review has room to actually finish its analysis (with track_progress: true the 5-turn budget was spent before it completed). timeout-minutes: 15 stays as the wall-clock guard.

Notes

• claude-review.yml triggers only on pull_request: opened, so this won't re-run on the already-opened PRs; it applies to PRs opened after merge. Existing red checks can be cleared by re-running the job or re-opening.
• saimiris-gateway has no claude-review.yml, so no mirror is needed there.

🤖 Generated with Claude Code

[matthieugouel]

Claude finished @matthieugouel's task in 37s —— View job

---

Review

• Read changed files and analyze diff
• Check for logic bugs, security issues, and CLAUDE.md violations

---

The change is correct and well-reasoned. Two findings worth noting:

continue-on-error: true silences all failures, not just turn-limit ones

This is the intentional tradeoff, and the PR description acknowledges it. But it means infrastructure failures (missing secrets, OAuth token expiry, GitHub API outages) will also show green and leave no obvious signal. Since this is a review-only action with no side effects beyond posting comments, the risk is low — a silent failure just means no review comments appear. Acceptable tradeoff for an advisory job.

--max-turns 20 with track_progress: true

track_progress: true uses turns for progress comment updates, so effective analysis turns are fewer than 20. That said, 20 is a reasonable ceiling for a review of typical PR sizes in this repo, and timeout-minutes: 15 still provides a hard wall-clock guard. No concern here.

No issues found with security (no new secrets or injection surfaces introduced), CLAUDE.md conventions (those apply to Rust source, not CI), or the bot-filter logic (unchanged).

LGTM.