feat(ci): gate review on workflow runs and apply caveman and ponytail

[kauereinbold]

Summary

• The wait-for-checks job now polls actions/runs?head_sha=<PR head> and waits until every workflow run except Claude PR Review itself is complete; the review runs only if all are success/neutral/skipped.
• Workflow runs exist from trigger time, so a workflow whose jobs have not started yet can no longer slip past the first poll (the race the review agent flagged on feat(ci): add PR review agent via Claude Code Action #402). Permissions: actions: read replaces checks: read.
• ADR-0008 wording updated.

Closes #404 (follow-up of #351)

Test plan

• actionlint clean
• Dry run of the poll command locally against PR test(go): add unit tests for Go API #403's head SHA lists the other workflow runs with status/conclusion
• On this PR: "Wait for other checks" holds until CodeQL and the other workflows complete, then "Review pull request" runs

[github-actions]

Reviewed the diff (workflow gate fix + ADR-0008 wording update). No prior review comments on this PR to reconcile against.

Findings

[minor] .github/workflows/claude-pr-review.yml: the initial sleep 30 before the first poll was dropped on the assumption that workflow runs register instantly (unlike check runs). That reasoning holds, and this very review ran under the updated gate, which is itself empirical proof the fix works. Still, a small fixed delay (5-10s) before the first API call would be a cheap safety margin against any propagation lag between multiple workflows being queued for the same push, in case the very first poll lands before every sibling run is indexed.

Checks performed

• Self-exclusion now filters on github.workflow (the workflow name "Claude PR Review"), which correctly covers both jobs in one entry since actions/runs is per-workflow, not per-job. No other workflow in .github/workflows/ shares that name, so no collision risk.
• permissions: actions: read matches the new actions/runs endpoint; checks: read is no longer used anywhere else in the job.
• Added stale to the failing-conclusion grep is a reasonable addition, not previously covered.
• Status/conclusion regexes match the documented actions/runs status vocabulary.
• PR title is conventional-commit compliant (fix(ci): ...), no em/en dashes anywhere in the diff, no AI attribution, change is minimal (no new dependencies), and ADR-0008 was updated to match the implementation.

Ready for human review.

[github-actions]

Reviewed full diff (CI gate fix + skill vendoring + doc updates). Checked against earlier review comment: sleep-30 finding already addressed (now sleep 10 with rationale), not re-raised.

[minor]

• PR bundles two unrelated changes: workflow-runs polling fix (bug, race from feat(ci): add PR review agent via Claude Code Action #402) and caveman/ponytail skill vendoring + prompt rewiring (feature). Title fix(ci) covers only the first. Split into two PRs, or retitle to reflect both.
• docs/adr/0008-pr-review-agent.md:27: Decision text updated for workflow-runs wording only. Still silent on the new behavior: review agent now reads and applies caveman/ponytail skills (wording style + review lens). Add a sentence, this is a prompt/process change per CLAUDE.md's ADR rule.

[nit]

• .claude/skills/caveman/SKILL.md: vendored file ships wenyan-lite/full/ultra tiers, repo only ever invokes "full" intensity. Trim to what's used, ponytail's own no-speculative-scope rule applies here too.
• .claude/skills/caveman/SKILL.md:1: MIT-licensed vendor copy keeps a one-line attribution comment, not the full license text. Add it if redistributing verbatim.

Correctness/security: no bugs found. env.SELF jq filter correctly collapses both jobs of this workflow into one exclusion since actions/runs is per-workflow not per-job (confirmed by prior review). Permissions scoped down correctly (checks:read to actions:read). No dashes, no AI attribution, no secrets.

Ready for human review.

[kauereinbold]

Addressed: PR retitled to cover both changes, ADR-0008 now records the skills, MIT license text added next to the vendored caveman skill. Kept the caveman SKILL.md verbatim on purpose (intensity tiers included) so it stays diffable against upstream; trimming it would make future syncs manual.

[github-actions]

Reviewed full diff (4 commits). Checked against both earlier reviews: sleep-10 delay, self-exclusion filter, ADR-0008 skills wording, MIT license text, and PR retitle all confirmed addressed. Wenyan tiers kept verbatim per maintainer's diffability rationale, not re-raised.

New material since last review (commit 4: max-turns bump, git diff/log/show tools, LICENSE file): no correctness or security issues. Turn cap raise and read-only git tools tie to observed failure (38 turns, 11 denials in prior run), not speculative scope.

[nit]

• PR title is 73 chars, CLAUDE.md caps subject at 72. Trim by at least one char.

Ready for human review.